Russh CVE-2026-73430

Exploitation requires only network access to the SSH port of a server built on Russh using its default configuration (Config::default(), which includes curve25519-sha256 via Preferred::DEFAULT). No authentication, no user interaction, and no non-default configuration setting is required - the vulnerable code path is exercised on the very first key-exchange message from any connecting client. Limiting factors: the Rust panic terminates only the per-connection KEX task; the broader server process and all other active sessions continue unaffected, so this is a per-connection DoS rather than full server shutdown. The vulnerability affects only server-mode Russh instances; a zero-check was also added to the client path in 0.62.4, but the pre-auth DoS is only directly triggerable by a malicious client connecting to a Russh server.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3) accurately reflects the attack surface: fully unauthenticated, network-reachable on any default Russh server, with low attack complexity since a single malformed packet triggers the panic. The availability impact is rated Low rather than High because Rust's panic mechanism terminates only the affected per-connection KEX task, not the entire server process, meaning concurrent legitimate sessions remain unaffected - though high-rate abuse could exhaust server worker resources. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation; the public proof-of-concept documented in GHSA-5xvq-cp9x-6p6r lowers the bar for opportunistic abuse and means that even a mid-sized municipal IT team in mielec running Russh-based SSH infrastructure would face ready-made exploit code against a default-configuration target. Given the absence of memory corruption, privilege escalation, or data exposure, this vulnerability falls into the routine-but-prompt patching tier for most operators - the primary concern is availability continuity under adversarial conditions, not systemic compromise.

An attacker opens a TCP connection to any exposed Russh-based SSH server, completes the SSH version string exchange, and sends a single SSH_MSG_KEX_ECDH_INIT packet with the 32-byte Q_C field set to all zeros. The server's key-exchange task panics immediately upon attempting to encode the resulting all-zero shared secret, terminating the connection before authentication. A working end-to-end proof-of-concept demonstrating this against unmodified Russh 0.62.2 is documented in GHSA-5xvq-cp9x-6p6r.