SSH Client and Server Library Vulnerability in russh by Eugeny

CVE-2026-128087

What is CVE-2026-128087?

The russh library, utilized for SSH client and server operations, contains a significant flaw in its key exchange process. Specifically, from versions 0.55.0 to 0.65.1, the library's initial key exchange sequence allows a malicious SSH server to exploit the system by executing application-specific initialization or early data handling before the server's host key or certificate is verified. While clients that utilize the no-op default behavior of the callback or postpone actions until trust is established are protected, the potential for manipulation exists for other configurations. This vulnerability was addressed in version 0.65.1, emphasizing the necessity of using the updated release to ensure secure communications.

References