russh CVE-2026-73429

The russh client must negotiate curve25519-sha256 as the key exchange algorithm, which is the default and preferred KEX in russh and most modern SSH implementations, so no non-default client configuration is required. The attacker must control or impersonate the SSH server that the russh client connects to - the attack cannot be initiated from client to server, and russh servers are not exploitable via this path because the server-side code already validates the ephemeral length. Exploitation is bounded to a session-level DoS: the spawned client session task panics and terminates, but the embedding Rust process remains running. There is no remote code execution path, no credential exposure, and no impact on the server side. The attack fires before any authentication or host key check, so no credentials or known-host entries assist in limiting it beyond preventing the connection entirely.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) scores 5.3 and accurately reflects the attack surface: remote, zero-complexity, unauthenticated exploitation yielding limited availability impact (session crash, not process crash). No EPSS data was provided in the intelligence feed, so exploitation probability cannot be quantified numerically. The absence of a CISA KEV listing indicates no confirmed active exploitation at analysis time, and the attack requires attacker control of an SSH server that a russh client connects to - meaning opportunistic mass exploitation is constrained by the need to lure or intercept client connections. A publicly available proof-of-concept is included in the GHSA advisory, lowering the bar for exploitation considerably. Real-world priority is moderate: the impact is a reliable session-level DoS (not RCE, no data exposure), but the zero-authentication, zero-complexity trigger against any russh client connecting to an attacker-controlled server makes this a credible threat in environments that programmatically SSH to untrusted hosts. Applications relying on russh for automated SSH connections to third-party or user-supplied servers are at elevated risk.

An attacker operates a rogue SSH server and causes a russh-based client application to connect to it - through DNS poisoning, a man-in-the-middle redirect, or by advertising a malicious endpoint to a user. During key exchange, the rogue server sends a KEX_ECDH_REPLY with a 16-byte server ephemeral (instead of the required 32 bytes), triggering a deterministic Rust panic in clone_from_slice at curve25519.rs:113 before host key verification is reached. A self-contained POC demonstrating this exact scenario is included in the GHSA advisory.