Russh CVE-2026-102822

Requires the russh deployment (<0.63.1) to be explicitly configured to permit mac=none in its algorithm preferences - a non-default hardening/weakening choice. When that is set, a remote peer can negotiate a MAC-requiring CTR or CBC block cipher (e.g. aes256-ctr, aes*-cbc, 3des, whose tag_len() is 0 with mac=none) because the selection logic only validated needs_mac() on the MAC-selection-failure branch. The attacker then sends a packet with a decrypted length of zero to trigger the panic. Limiting factors: the mac=none configuration is not default, exploitation is high-complexity, and the impact is confined to crashing the connection task (availability only) with no code execution or data exposure.

This is a genuinely low-severity, availability-only issue whose signals are internally consistent. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, score 3.7) correctly reflects a remote, unauthenticated but high-complexity denial-of-service with no confidentiality or integrity impact - the panic terminates only the affected connection task, not necessarily the whole process. AC:H is warranted because exploitation depends on a non-default configuration (the operator must permit mac=none) that then gets paired with a MAC-requiring CTR/CBC cipher. No EPSS score, KEV listing, or public exploit was provided, so this is 'no public exploit identified at time of analysis.' The 'Information Disclosure' tag conflicts with the actual impact (C:N; the effect is a panic/crash, A:L) and should be treated as mislabeled. Bottom line: low real-world priority - a config-gated, low-impact crash rather than a widespread or weaponizable flaw. CWE-129 (improper array-index validation) matches the root cause: the code indexes buffer.buffer[16..] after the probe block is shrunk below the expected length.

An operator deploys a russh-based SSH server/client (<0.63.1) whose preferences permit mac=none. A remote peer negotiates a MAC-requiring CTR or CBC cipher together with mac=none (allowed because the code only enforces needs_mac() on the MAC-selection-failure path), then sends a packet whose decrypted length is zero. The read path in cipher/mod.rs shrinks the already-read block and panics on the buffer[16..] slice, terminating the connection task. No public PoC is referenced, though the fix commit ships a regression test that constructs the triggering KEXINIT.