Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T21:17:41.750Z",
  "pubdate": "2026-08-12T21:17:41.750Z",
  "executiveSummary": "A denial-of-service vulnerability exists in the Russh SSH client library prior to version 0.62.4, specifically involving the processing of key exchange messages. The flaw is classified as a panic-inducing denial of service caused by missing input validation.\nA malicious SSH server can exploit this vulnerability by transmitting a malformed KEX_ECDH_REPLY message containing a server ephemeral value with an unexpected length during the cryptographic key exchange phase. This triggers a deterministic panic in the client-side Curve25519Kex::compute_shared_secret function before the server host key is verified.\nThe resulting panic abnormally terminates the spawned client session task and surfaces as a JoinError to the embedding application, although the broader process typically remains running. The attacker requires the capability to position themselves as an SSH server or compromise an existing server connection to send the crafted payload. No authentication or elevated privileges are required to initiate the attack, as it occurs during the initial handshake.\nThe risk implication is service disruption for individual client sessions interacting with untrusted or compromised SSH endpoints. Remediation requires upgrading the Russh library to version 0.62.4 or later, where proper length validation for the server ephemeral value is implemented.",
  "technicalDetails": "The vulnerability resides in the Curve25519 key exchange implementation of the Russh library, specifically within the Curve25519Kex::compute_shared_secret function located at russh/src/kex/curve25519.rs. The vulnerable component is responsible for processing the server ephemeral value received from a remote peer during the Diffie-Hellman key exchange over Curve25519.\nThe root cause of the vulnerability is the absence of input validation regarding the byte length of the decoded exchange.server_ephemeral value. The function directly passes this value to the clone_from_slice method without verifying whether it conforms to the expected 32-byte length requirement for Curve25519 public keys.\nThe attack flow proceeds as follows during the establishment of an SSH connection. First, the Russh client initiates an SSH handshake with a remote server, proceeding to the key exchange phase. A malicious or compromised SSH server responds with a malformed KEX_ECDH_REPLY message containing an invalid server ephemeral value whose length is not 32 bytes.\nUpon receiving this message, the Russh client invokes Curve25519Kex::compute_shared_secret to derive the shared secret. Because the code attempts to copy the unvalidated slice into a fixed-size buffer using clone_from_slice without a preceding length check, a Rust panic is triggered deterministically.\nThis panic occurs strictly prior to the verification of the server host key, meaning the client crashes its session task before any trust relationship with the server can be validated. The panic unwinds the spawned client session task, resulting in a JoinError returned to the embedding process.\nAffected versions include all Russh client implementations prior to version 0.62.4. The network exposure is inherent to any SSH client utilizing vulnerable versions of Russh to connect to untrusted remote servers over the network. No authentication or pre-existing privileges are required by the attacker beyond the ability to complete the initial TCP handshake and send a malicious KEX_ECDH_REPLY message.\nThe post-exploitation impact is limited to a denial of service of the specific client session task. While the embedding application normally remains running, repeated exploitation can lead to resource exhaustion or application instability if session management lacks robust error handling for JoinErrors."
}