Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an all-zero shared secret, after which compute_exchange_hash calls encode_mpint in russh/src/kex/mod.rs and indexes beyond the end of the input while skipping leading zero bytes. The resulting panic occurs before authentication and terminates the server key-exchange task. This issue is fixed in version 0.62.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T21:17:41.883Z",
  "pubdate": "2026-08-12T21:17:41.883Z",
  "executiveSummary": "A denial of service vulnerability exists in the Russh SSH library prior to version 0.62.4.\nThe vulnerability arises from improper validation of cryptographic public values during the key exchange phase.\nUnauthenticated remote attackers can exploit this flaw by supplying a specifically crafted 32-byte all-zero Q_C value within an SSH_MSG_KEX_ECDH_INIT message.\nSuccessful exploitation forces the server key-exchange task to panic, resulting in the abrupt termination of the server session and causing a denial of service.\nNo authentication or elevated privileges are required to launch this attack against exposed network services.\nThe risk is mitigated by updating the Russh library to version 0.62.4 or later, which correctly handles or rejects invalid public values.",
  "technicalDetails": "The root cause of the vulnerability resides in the cryptographic key exchange implementation located in russh/src/kex/curve25519.rs, specifically within the Curve25519Kex::server_dh function.\nDuring the Elliptic-Curve Diffie-Hellman (ECDH) key exchange initialization, the server processes incoming peer public values supplied by the client.\nPrior to version 0.62.4, Curve25519Kex::server_dh accepts an all-zero peer public value ($Q_C$) without validating its cryptographic safety or scalar validity.\nAccepting an all-zero public value leads to the computation of an all-zero shared secret.\nSubsequently, the execution flow proceeds to compute_exchange_hash, which invokes encode_mpint in russh/src/kex/mod.rs.\nDuring the execution of encode_mpint, the routine attempts to skip leading zero bytes within the generated shared secret mpint representation.\nDue to the fully zeroed shared secret, the indexing logic attempts to advance past the bounds of the input buffer, resulting in an out-of-bounds index operation.\nThis out-of-bounds condition triggers an unhandled Rust panic.\nBecause this key exchange procedure occurs prior to client authentication, any unauthenticated network attacker with connectivity to the SSH service can trigger the panic.\nThe attack flow proceeds as follows: 1) The unauthenticated client initiates an SSH connection. 2) During key exchange, the client transmits an SSH_MSG_KEX_ECDH_INIT message containing a 32-byte all-zero Q_C value. 3) The Russh server parses the message and executes Curve25519Kex::server_dh. 4) The server computes an all-zero shared secret. 5) compute_exchange_hash and encode_mpint process the shared secret, causing an out-of-bounds indexing panic. 6) The server task crashes, terminating the connection and denying service to legitimate users."
}