Malicious SSH Server Vulnerability in Russh Rust Client & Server Library

CVE-2026-73429

What is CVE-2026-73429?

The Russh library, a Rust implementation of an SSH client and server, is susceptible to a malfunction when a malicious SSH server sends a malformed KEX_ECDH_REPLY. This exploit involves sending a server ephemeral value that fails to meet the required length of 32 bytes. As a result, the Curve25519Kex::compute_shared_secret function processes this invalid value without proper validation, leading to a deterministic panic during the client session. This panic disrupts the spawned session, manifesting as a JoinError, while the parent process continues to run unaffected. This issue was rectified in version 0.62.4, emphasizing the importance of updating to ensure security.

References