Denial of Service Vulnerability in Russh SSH Client & Server Library

CVE-2026-73430

What is CVE-2026-73430?

The Russh SSH client and server library is susceptible to a denial-of-service vulnerability that can be exploited by an unauthenticated SSH client. When the SSH_MSG_KEX_ECDH_INIT message is sent with a 32-byte all-zero Q_C value, it leads to an error during the key exchange process. Specifically, the Curve25519Kex::server_dh function accepts this all-zero public value and computes an all-zero shared secret. This results in an attempt to index beyond the end of the input, causing a panic that terminates the server's key-exchange task before authentication can take place. This vulnerability has been addressed in version 0.62.4 of the Russh library.

References