CVE-2026-73429: 
Rust vulnerability analysis and mitigation

CVE-2026-73429 is a pre-authentication Denial-of-Service vulnerability in russh, a Rust SSH client and server library. A malicious SSH server can crash a russh client session by sending a malformed KEX_ECDH_REPLY message containing a server ephemeral value that is not 32 bytes long, triggering a deterministic panic before host key verification. All versions prior to 0.62.4 are affected. The vulnerability was published on August 12, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an improper check for unusual conditions (CWE-754) combined with an incorrect type conversion (CWE-704): the client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value directly to clone_from_slice without first validating that its length is exactly 32 bytes. This is an asymmetric validation gap — the server-side server_dh function and all other key exchange paths (ML-KEM, ECDH-NIST, DH/GEX) already perform this length check, but the client-side Curve25519 path was overlooked. When a malformed KEX_ECDH_REPLY with a non-32-byte ephemeral (e.g., 16 bytes) is received, Rust's clone_from_slice panics deterministically, terminating the spawned client session task and surfacing as a JoinError. A standalone proof-of-concept is included in the advisory repository at vuln_poc/vuln_002_client_wronglen_x25519_panic/ (GitHub Advisory, Fix Commit).

Successful exploitation causes a per-connection Denial-of-Service: the client's SSH session task panics and is killed before host key authentication completes. The embedding process itself normally remains running, so the impact is scoped to the individual connection rather than a full process crash — unless the embedder installs a custom panic hook that calls std::process::abort. There is no confidentiality or integrity impact; the attack cannot be used to exfiltrate data or modify state, but it can be used to reliably and repeatedly disrupt any russh-based client that negotiates curve25519-sha256 (the default and most-preferred key exchange algorithm) with an attacker-controlled or MitM-reachable server (GitHub Advisory).

A self-contained PoC is publicly available in the russh advisory repository, demonstrating reliable reproduction with a single malformed packet. No privileges are required, no user interaction is needed, and the attack succeeds before host key verification — meaning any network position capable of delivering a forged KEX_ECDH_REPLY (rogue server or MitM) is sufficient. The EPSS score is 0.0 and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date (GitHub Advisory).

1. Set up a malicious SSH server: Deploy a rogue SSH server (or perform a MitM interception) reachable by the target russh client, ensuring the client will negotiate curve25519-sha256 key exchange (the default in russh).
2. Complete the initial handshake: Allow the TCP connection to be established and exchange SSH identification strings and KEXINIT messages normally with the client.
3. Receive the client's KEX_ECDH_INIT: Wait for the client to send its KEX_ECDH_INIT message containing its 32-byte Curve25519 ephemeral public key.
4. Send a malformed KEX_ECDH_REPLY: Craft and send a KEX_ECDH_REPLY (message type 0x1f) with the server ephemeral field (f) set to a non-32-byte value (e.g., 16 bytes of 0x00). The length prefix should be 0x00000010 (16 in big-endian), followed by 16 zero bytes. The host key blob and signature fields can contain arbitrary bytes.
5. Trigger the panic: The russh client decodes the malformed ephemeral into a Vec<u8> of length 16 and passes it to compute_shared_secret, which calls clone_from_slice on a 32-byte array, causing a deterministic panic that kills the client session task (GitHub Advisory).

• Logs: Rust panic messages in application logs referencing russh/src/kex/curve25519.rs:113 with text such as copy_from_slice: source slice length (16) does not match destination slice length (32); JoinError entries from the tokio runtime associated with SSH client session tasks.
• Network: Unexpected or repeated SSH connection attempts that terminate abruptly during key exchange (before authentication); SSH traffic where the server sends a KEX_ECDH_REPLY with a malformed ephemeral field length (not 32 bytes) in the curve25519-sha256 exchange.
• Process: Repeated spawning and immediate termination of SSH client session tasks in russh-based applications; application-level errors indicating failed SSH connections with no corresponding authentication attempt (GitHub Advisory).

Upgrade russh to version 0.62.4 or later, which adds a length validation check at the top of compute_shared_secret (returning Err(crate::Error::Kex) if the remote public key is not exactly 32 bytes) and also rejects all-zero Curve25519 keys (Fix Commit, Release Notes). As a temporary workaround for deployments that cannot upgrade immediately, disable curve25519-sha256 in the Preferred::kex list and configure a key exchange algorithm whose peer-ephemeral length is already validated (e.g., ECDH-NIST or DH/GEX paths). This workaround reduces exposure but is not a complete fix (GitHub Advisory).

The vulnerability was reported by researcher Zhaodl1 and disclosed via GitHub Security Advisories by the russh maintainer (Eugeny) on July 22, 2026. The advisory notes that the bug is easy to miss in code review due to the asymmetric validation gap between the client and server paths. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (GitHub Advisory).