CVE-2026-73430: 
Rust vulnerability analysis and mitigation

CVE-2026-73430 is a pre-authentication denial-of-service vulnerability in russh, a Rust SSH client and server library. An unauthenticated attacker can crash the server's key-exchange task by sending a single SSH_MSG_KEX_ECDH_INIT message with a 32-byte all-zero Curve25519 public key (Q_C), triggering a Rust index-out-of-bounds panic in encode_mpint before any authentication occurs. All versions prior to 0.62.4 are affected, including the default server configuration (Config::default()). The vulnerability was published on August 12, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an improper check for unusual or exceptional conditions (CWE-754): Curve25519Kex::server_dh() in russh/src/kex/curve25519.rs accepts the all-zero Curve25519 point (the identity/low-order element) as a valid peer public key without validation, violating RFC 7748 §6. Scalar multiplication of any value by the all-zero MontgomeryPoint yields an all-zero shared secret, which is then passed to encode_mpint() in russh/src/kex/mod.rs. The encode_mpint function skips leading zero bytes by advancing index i until i == s.len(), then immediately indexes s[i] (i.e., s[32] on a 32-byte slice), causing an index-out-of-bounds panic. This panic occurs in the server's async KEX task before host-key signature verification, meaning no authentication is required. A public end-to-end proof-of-concept is included in the GitHub advisory, requiring only a 37-byte crafted packet (GitHub Advisory, Fix Commit).

Successful exploitation causes a remote, pre-authentication denial of service against any russh SSH server using the default configuration. The server's KEX handler task panics and terminates the affected connection; depending on the embedder's panic containment strategy, the panic may also tear down the entire server process rather than just the individual connection. There is no demonstrated confidentiality or integrity impact — no memory corruption, data exfiltration, or remote code execution is possible via this vulnerability (GitHub Advisory).

A working end-to-end proof-of-concept is publicly available in the GitHub security advisory, demonstrating the panic against an unmodified russh 0.62.2 server over a real TCP connection. Exploitation requires no authentication, no privileges, and no user interaction — a single 37-byte SSH packet is sufficient. The EPSS score is 0.0 as of the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory).

1. Identify target: Locate a service running a russh-based SSH server (versions ≤ 0.62.3) with the default configuration, which includes curve25519-sha256 in the key exchange algorithm list.
2. Establish TCP connection: Open a raw TCP connection to the target SSH port (typically 22) and exchange SSH version banners (e.g., send SSH-2.0-attacker\r\n).
3. Send SSH_MSG_KEXINIT: Transmit a valid SSH_MSG_KEXINIT packet advertising curve25519-sha256 as the sole supported key exchange algorithm to force the server to select Curve25519 KEX.
4. Send malicious SSH_MSG_KEX_ECDH_INIT: Transmit a SSH_MSG_KEX_ECDH_INIT packet (message type 0x1e) with Q_C set to 32 zero bytes (\x00 × 32), totaling approximately 37 bytes.
5. Server panics: The server's server_dh() accepts the all-zero public key, computes an all-zero shared secret, and encode_mpint() panics with an index-out-of-bounds error, terminating the KEX task before authentication. The connection drops with no SSH_MSG_KEX_ECDH_REPLY returned.
6. Repeat for sustained DoS: Repeat the above steps in a loop to continuously crash new connection handlers, potentially disrupting server availability (GitHub Advisory).

• Network: Repeated inbound SSH connections that terminate abruptly after the key exchange initiation phase, with no completed handshake; connections sending SSH_MSG_KEX_ECDH_INIT (message type 0x1e) with a 32-byte all-zero payload.
• Logs: Rust panic messages in server logs referencing russh/src/kex/mod.rs:482 with the text index out of bounds: the len is 32 but the index is 32; repeated task termination events in the russh server's async runtime logs.
• Process: Abnormal termination of tokio worker threads associated with SSH session handling; server process crash or restart if panic containment is not per-connection (GitHub Advisory).

Upgrade russh to version 0.62.4, which fixes the vulnerability by (1) rejecting all-zero Curve25519 peer public values in server_dh() and compute_shared_secret() with an explicit check before scalar multiplication, and (2) hardening encode_mpint() to handle all-zero input by returning an empty mpint per RFC 4251 §5. No configuration-based workaround is available for unpatched versions, as the default Config::default() is affected. The fix is in commit a7fc1eb5717264e31c3c5f7dd849b73989a08f3d (Fix Commit, Release v0.62.4).

The vulnerability was independently reported by two researchers, Zhaodl1 and the diff/ambidiff security research effort (afldl), and was published as a GitHub Security Advisory (GHSA-5xvq-cp9x-6p6r). The advisory notes that the bug was not covered by any of the 11 previously published russh GHSA advisories. No significant broader media coverage or social media discussion has been identified beyond the advisory itself (GitHub Advisory).