CVE-2026-73429: Russh SSH Library DOS Vulnerability

CVE-2026-73429 Overview

CVE-2026-73429 affects Russh, a Rust SSH client and server library, in versions prior to 0.62.4. A malicious SSH server can crash a Russh client session by sending a malformed KEX_ECDH_REPLY message containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length. This triggers a deterministic panic before the server host key is verified. The issue is fixed in version 0.62.4.

Critical Impact
A malicious SSH server can deterministically crash Russh client session tasks before host key verification, causing denial of service against embedding applications.

Affected Products

Russh SSH library versions prior to 0.62.4
Applications embedding Russh as an SSH client
Rust projects using Russh for Curve25519 key exchange

Discovery Timeline

2026-08-12 - CVE CVE-2026-73429 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73429

Vulnerability Analysis

The vulnerability resides in the Curve25519 key exchange handling within Russh. When a Russh client processes a KEX_ECDH_REPLY message from a server, the Curve25519Kex::compute_shared_secret function extracts the server's ephemeral public key from the wire and forwards the bytes to clone_from_slice. The Curve25519 algorithm requires a fixed 32-byte public key. If a server sends an ephemeral value of any other length, clone_from_slice panics because the source slice length does not match the fixed-size destination array.

This panic occurs before host key verification, so the attacker does not need to control a trusted server. Any server the client connects to, including a man-in-the-middle, can trigger the crash. The panic terminates the spawned client session task and surfaces as a JoinError in the embedding process. The embedder typically continues running, but the SSH connection and any dependent workflow fail.

Root Cause

The root cause is missing input validation on attacker-controlled protocol data, classified as an incorrect type conversion or cast [CWE-704]. The decoder trusts the length reported for server_ephemeral and copies it directly into a fixed 32-byte buffer without a length check. Rust's slice-copy primitives enforce length equality via a runtime assertion, converting the malformed input into an unrecoverable panic.

Attack Vector

Exploitation requires only that a Russh client initiate an SSH connection to an attacker-controlled endpoint. The attacker sends a crafted KEX_ECDH_REPLY with a server_ephemeral field whose length is not 32 bytes. No authentication, credentials, or user interaction beyond initiating the connection are required. The attack executes over the network and repeats reliably.

rust

// Patch excerpt from russh/src/kex/curve25519.rs
            pubkey
        };

+       if client_pubkey.0 == [0u8; 32] {
+           debug!("client sent zero curve25519 pubkey");
+           return Err(crate::Error::Kex);
+       }
+
        let server_secret = Scalar::from_bytes_mod_order(rand::random::<[u8; 32]>());
        let server_pubkey = (ED25519_BASEPOINT_TABLE * &server_secret).to_montgomery();

Source: GitHub Commit a7fc1eb

The patch also hardens mpint encoding in russh/src/kex/mod.rs, correctly handling all-zero scalars that previously fell through the leading-zero strip loop.

Detection Methods for CVE-2026-73429

Indicators of Compromise

Repeated JoinError values surfacing from Russh client session tasks in application logs
Client-side panics referencing clone_from_slice inside russh::kex::curve25519
SSH sessions terminating during key exchange before host key verification completes

Detection Strategies

Audit Cargo.lock files across Rust projects for russh versions below 0.62.4
Monitor client applications for abrupt task termination during outbound SSH handshakes
Correlate outbound SSH connections that fail during key exchange with untrusted or newly resolved destinations

Monitoring Recommendations

Enable structured logging on Russh embedders so JoinError events include the remote peer address
Track SSH connection failure rates per destination to surface anomalous crash patterns
Alert on outbound SSH traffic to endpoints that repeatedly cause client-side handshake termination

How to Mitigate CVE-2026-73429

Immediate Actions Required

Upgrade Russh to version 0.62.4 or later in all dependent projects
Rebuild and redeploy any binary that embeds Russh as an SSH client
Restrict outbound SSH client connections to trusted destinations until patches are applied

Patch Information

The fix is available in Russh 0.62.4. Review the GitHub Security Advisory GHSA-g9hv-x236-4qp3, the GitHub Release v0.62.4, and the upstream commit for full details. The patch adds length and value validation for Curve25519 public keys and corrects mpint encoding for zero scalars.

Workarounds

Limit Russh clients to allowlisted SSH servers via network policy or egress firewall rules
Wrap Russh client tasks with supervisor logic that restarts failed sessions and rate-limits reconnect attempts
Where feasible, disable Curve25519 key exchange in favor of algorithms not affected by this decoder path

bash

# Update the Russh dependency in Cargo.toml
cargo update -p russh --precise 0.62.4
cargo build --release