METADATA

VENDOR_NAME: Russh

AFFECTED_VERSION: < 0.62.4

MITRE_TACTIC: T1499 — Endpoint Denial of Service

SHODAN_DORKS: ["port:22 product:SSH", "banner:SSH-2.0", "port:22 ssh-2.0"]

CWE_ID: CWE-704

CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

POC_STATUS: None (no public PoC, Nessus/Nuclei template, or exploit code identified)

PATCH_DETAILS: Fixed in russh 0.62.4 per OSV (patch confidence 2/4 — claimed, not independently confirmed)

Executive Summary

CVE-2026-73429 is a remotely triggerable denial-of-service vulnerability in the russh Rust SSH client and server library affecting all client versions prior to 0.62.4. A malicious SSH server can crash a russh client's session task by sending a malformed KEX_ECDH_REPLY message containing a Curve25519 ephemeral value that is not exactly 32 bytes long, causing a deterministic panic in the client's key-exchange logic before the server host key is verified. The impact is limited to availability loss of the SSH session (CVSS 3.1 base score 5.3, Medium); no code execution, data exposure, or full process compromise is indicated.

Technical Analysis

The vulnerability is located in the client-side Curve25519 key-exchange path. In russh/src/kex/curve25519.rs, the Curve25519Kex::compute_shared_secret function processes the decoded exchange.server_ephemeral value supplied by the remote server and passes it directly to clone_from_slice without first validating its length. In Rust, slice::clone_from_slice panics at runtime when the source slice length does not match the destination slice length. Because the server's ephemeral public key must be exactly 32 bytes for Curve25519, any other length — 0 bytes, 1 byte, 16 bytes, 64 bytes, etc. — triggers a deterministic panic in the client process.

The triggering event is a malicious KEX_ECDH_REPLY message sent during the key-exchange phase of the SSH handshake, specifically when a Curve25519-based key exchange algorithm such as curve25519-sha256 has been negotiated. Key-exchange messages are sent before encrypted channel establishment, so the crafted packet is visible and processable at the network layer. Notably, the panic occurs before the server host key is verified; therefore, clients that enforce strict host-key checking are still affected when connecting to an attacker-controlled or impersonated endpoint.

The panic unwinds the spawned client session task and surfaces as a JoinError to the embedding application. According to the NVD description, the embedding process normally remains running, so the observable symptom is a terminated SSH session task rather than a full application crash. This is consistent with the CVSS availability subscore of Low (A:L) and the overall Medium severity rating of 5.3.

The assigned weakness class is CWE-704 (Incorrect Type Conversion or Cast). The library implicitly treats the untrusted remote value as a fixed 32-byte type without an explicit, validated conversion; the missing length check creates a type/length mismatch that is only discovered at the panic point. Strictly speaking, the more precise root cause is an unvalidated length assumption on an untrusted network input, but CWE-704 is the classification used by the CNA. Insufficient additional technical detail is available beyond the NVD description; no further function-level specifics should be inferred.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available at the time of writing. The attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker does not scan for vulnerable clients directly because this is a client-side flaw. Instead, the attacker operates a malicious SSH server (or compromises/impersonates a legitimate one via DNS hijacking or network-level interception) and waits for, or lures, a russh-based client to initiate a connection. Typical targets include applications using russh for SSH automation, CI/CD pipelines, file-transfer tooling, or remote administration frontends that accept user-supplied SSH endpoints.

2. Triggering the flaw: When the client and the malicious server negotiate a Curve25519-based key exchange, the server responds with a crafted KEX_ECDH_REPLY message whose server ephemeral value (exchange.server_ephemeral) has a length other than 32 bytes.

3. Execution method (vulnerability-class level): The client invokes Curve25519Kex::compute_shared_secret, which passes the attacker-controlled value to clone_from_slice. The resulting slice-length mismatch triggers a Rust panic. Because this occurs during key exchange and before server host key verification, no prior authentication or successful host validation is required for the crash to occur. No code execution is achieved — the attacker only causes a deterministic process-level exception.

4. Post-exploitation impact: The panic terminates the client's session task, surfacing as a JoinError in application logs. Repeated connection attempts produce repeated session failures, effectively denying the client the ability to establish SSH connections to the malicious server — and, if the attacker can redirect traffic destined for a legitimate server, causing reliable availability disruption of the client application's SSH-dependent workflows. No confidentiality or integrity impact is associated with this CVE.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vulnerability is network-reachable, requires low attack complexity, needs no privileges and no user interaction, and does not change the security scope. The availability impact is Low: the crash affects the spawned SSH session task, not the host process or underlying system.

The blast radius covers any application embedding russh as an SSH client on versions below 0.62.4. Because the panic occurs prior to host key verification, all russh client connections to untrusted or impersonated SSH servers are affected, regardless of strict host-key checking configuration. Business impact is primarily operational: disruption of SSH-based automation, orchestration, file-transfer jobs, and remote administration workflows. There is no indication of data breach, credential disclosure, or lateral movement potential associated with this CVE. EPSS score 0.00291 (21.7th percentile) suggests a low likelihood of exploitation in the wild as of the report date.

Detection Guidance

Detection is primarily log-centric because the vulnerability manifests as a Rust panic and a JoinError in the embedding application. Network-level detection is feasible in principle because key-exchange messages are sent before channel encryption, but precise detection requires parsing the variable-length TLV structure of KEX_ECDH_REPLY; the signatures below are heuristics and should be tuned to the local log schema and traffic profile.

Sigma Rule

title: CVE-2026-73429 - Russh SSH Client Panic on Malformed KEX_ECDH_REPLY
id: 7f3e2c91-6a4b-4b8d-9e2f-1c5a0d8b7342
status: experimental
description: >
  Detects application log lines indicating a russh client panic in the
  curve25519 key-exchange path, consistent with CVE-2026-73429.
logsource:
  category: application
  product: rust
detection:
  selection_panic:
    message|contains|all:
      - 'panicked at'
      - 'clone_from_slice'
  selection_kex:
    message|contains|any:
      - 'curve25519'
      - 'KEX_ECDH_REPLY'
      - 'server_ephemeral'
      - 'JoinError'
  filter_fixed:
    message|contains: '0.62.4'
  condition: (selection_panic or selection_kex) and not filter_fixed
fields:
  - message
falsepositives:
  - Unrelated Rust panics involving clone_from_slice in other libraries
level: high

YARA Rule

rule CVE_2026_73429_russh_curve25519_panic
{
    meta:
        author = "Valters IT SOC"
        description = "Detects source code or binary strings associated with the vulnerable russh curve25519 KEX path (CVE-2026-73429)"
        cve = "CVE-2026-73429"
        date = "2026-02-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73429"
    strings:
        $s1 = "clone_from_slice" ascii wide
        $s2 = "server_ephemeral" ascii wide
        $s3 = "KEX_ECDH_REPLY" ascii wide
        $s4 = "curve25519.rs" ascii wide
        $s5 = "compute_shared_secret" ascii wide
    condition:
        filesize < 50MB and 3 of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp any any -> any 22 (
    msg:"CVE-2026-73429 Suspicious SSH KEX_ECDH_REPLY (possible malformed curve25519 ephemeral)";
    flow:established,to_client;
    content:"|1f|"; depth:6;
    dsize:40<>120;
    classtype:attempted-dos;
    sid:2026734291; rev:1;
    reference:cve,2026-73429;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-73429;
)

Note: 0x1f is the SSH KEX_ECDH_REPLY message type byte within the SSH binary packet payload. Because the offset of the server ephemeral (mpint Q_S) length field depends on the variable-length host-key string (K_S) that precedes it, this rule uses a payload-length heuristic. For precise inspection of the ephemeral length field, augment with a protocol-aware parser (e.g., Suricata Lua script or Zeek SSH analyzer) rather than relying on this signature alone.

Elastic Detection

any where
  (message : "*curve25519*" or message : "*clone_from_slice*" or message : "*KEX_ECDH_REPLY*")
  and (message : "*panicked at*" or message : "*JoinError*" or message : "*panic*")

Splunk SPL Query

index=* sourcetype=* (message="*curve25519*" OR message="*clone_from_slice*" OR message="*KEX_ECDH_REPLY*" OR message="*server_ephemeral*")
| where match(_raw, "(?i)panicked at") OR match(_raw, "(?i)JoinError") OR match(_raw, "(?i)clone_from_slice")
| eval cve="CVE-2026-73429"
| table _time, index, host, source, cve, _raw
| sort - _time

Wazuh OSSEC Rule

<group name="russh,">
  <rule id="100734" level="10">
    <regex>panicked at .*clone_from_slice|clone_from_slice .*panicked at|KEX_ECDH_REPLY</regex>
    <description>CVE-2026-73429: Possible russh SSH client panic on malformed KEX_ECDH_REPLY</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>russh,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this CVE is 2/4 (CLAIMED): a single source (OSV) reports the fix, but it has not been independently confirmed via a vendor advisory. Treat the patch status with caution until verified.

1. Immediate mitigations: No vendor-provided workaround is available. Until the fix is verified, restrict russh client connections to trusted SSH servers only. If the application accepts user-supplied SSH endpoints, enforce an allowlist of permitted destinations and block egress SSH traffic to untrusted networks at the perimeter. Monitor application logs for the panic signatures described above.

2. Patch/upgrade steps: Upgrade russh to version 0.62.4 or later (cargo update -p russh for Cargo-based projects). Independently verify that the updated crate contains the corrected length validation by reviewing the crate changelog or diff for russh/src/kex/curve25519.rs. Rebuild and regression-test client connections against a legitimately configured SSH server after upgrading.

3. Long-term hardening: Advocate with the maintainers for explicit length validation on all parsed key-exchange values at the library level; wrap SSH session tasks with panic-catching/graceful-degradation logic so that a panic in one task cannot propagate unstable behavior to the embedding application; subscribe to OSV/RustSec advisories for russh and related SSH crates; and consider network-level monitoring of KEX_ECDH_REPLY anomalies for clients operating in high-risk network environments.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73429
• OSV Advisory: https://osv.dev/vulnerability/CVE-2026-73429
• Crates.io (russh package): https://crates.io/crates/russh
• CISA KEV: Not listed. No known exploitation-in-the-wild evidence, threat-actor campaigns, or public proof-of-concept code was identified as of the report date. EPSS score 0.00291 (21.7th percentile) indicates a low current likelihood of exploitation.