CVE-2026-102824: Russh Package Suffers from Missing X25519 Zero-Point Validation in Hybrid Key Exchange
Summary
CVE-2026-102824: Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange. Affects russh versions < 0.63.0. Fixed in 0.63.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Russh package is a Rust implementation of the SSH protocol, designed to facilitate secure communication over unsecured networks. It supports various key exchange mechanisms, including hybrid key exchanges that combine classical and post-quantum algorithms for enhanced security. However, a vulnerability has been identified in the hybrid ML-KEM 768 + X25519 key exchange implementation, which fails to validate that the remote peer's X25519 public key is not the zero point, potentially compromising the security of the key exchange process.
Vulnerability Detail
The vulnerability arises from the lack of validation for the X25519 public key in the hybrid ML-KEM key exchange implementation. Specifically, the code does not check if the received X25519 public key is an all-zero 32-byte value. This oversight allows an attacker to send a zero public key, which results in the shared secret being reduced to the ML-KEM component alone, thereby weakening the overall security of the key exchange. The root cause can be traced back to a commit that added zero-point validation to another part of the code but failed to apply the same fix to the hybrid implementation. The impact is significant as it undermines the defense-in-depth strategy of hybrid key exchanges, exposing sessions to potential vulnerabilities if either algorithm is compromised.
How To Fix
Latest published version: 0.64.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.63.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than updating to the patched version of the Russh package. It is advisable to monitor the implementation and avoid using the hybrid ML-KEM key exchange until the update is applied.
Conclusion
The Russh package contains a vulnerability related to the hybrid ML-KEM key exchange implementation, which lacks proper validation for the X25519 public key. This oversight can lead to weakened security during key exchanges. Users are advised to update to version 0.63.0 or later to mitigate this risk and ensure robust security in their applications.
See every vulnerability recorded for russh →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include the reduction of security during key exchanges, as an attacker can force the shared secret to depend solely on the ML-KEM component, compromising the defense-in-depth strategy.
Yes, if the ML-KEM component is later found to have weaknesses, sessions that relied on a zeroed-out X25519 component may lose their fallback protection, increasing the risk of data exposure.
If immediate updates are not possible, it is recommended to avoid using the hybrid ML-KEM key exchange until the vulnerability is patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for russh.
