Denial-of-Service Vulnerability in Russh Client Due to X25519 Key Exchange Panic
Summary
GHSA-g9hv-x236-4qp3: Russh: client wrong-length X25519 clone_from_slice panic (pre-auth DoS). Affects russh versions < 0.62.4. Fixed in 0.62.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Russh is an open-source Rust library that implements the SSH protocol, allowing secure remote access and communication. It supports various key exchange algorithms, including curve25519-sha256, which is the default and most preferred. The library is designed for performance and security, but a recent vulnerability has been identified that can lead to a Denial-of-Service (DoS) condition when connecting to a malicious SSH server.
Vulnerability Detail
A vulnerability exists in the Russh client where a malicious SSH server can send a malformed key-exchange reply, specifically a KEX_ECDH_REPLY with an incorrect length for the server ephemeral key. This causes the Russh client to panic during the execution of the compute_shared_secret function, leading to a pre-authentication Denial-of-Service. The panic occurs because the client does not validate the length of the received ephemeral key before attempting to clone it, resulting in a deterministic crash of the client session. This vulnerability is classified under CWE-704, indicating an incorrect type conversion or cast, and has a CVSS score of 5.3.
How To Fix
Latest published version: 0.64.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.62.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, clients can disable the curve25519-sha256 key exchange algorithm in their preferred list and opt for a key exchange algorithm that validates peer ephemeral lengths, such as ECDH-NIST or DH/GEX. This can be done by modifying the Preferred::kex setting in your SSH client configuration.
Conclusion
The Russh client has a vulnerability that can be exploited by malicious SSH servers to cause a Denial-of-Service condition. It is crucial for users to update to the patched version 0.62.4 or later to mitigate this risk. Until then, applying the recommended workaround can help reduce exposure to this vulnerability.
See every vulnerability recorded for russh →
FAQ
The vulnerability allows a malicious SSH server to crash the Russh client, leading to a Denial-of-Service condition. This means that the client will be unable to establish a connection until restarted.
Any deployment using the Russh client to connect to potentially malicious or Man-in-the-Middle (MitM) reachable SSH servers is at risk. This includes applications that rely on Russh for secure communication.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up or install anything.
If you cannot update the Russh package right away, implement the suggested workaround by disabling the curve25519-sha256 key exchange algorithm and opting for a safer alternative.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for russh.
