CVE-2026-73429

The record

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.

Affected packages

Related vulnerabilities

• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-704
• CVE-2026-10080 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to… CWE-704
• CVE-2026-15826 The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via… CWE-704
• CVE-2026-53798 rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… CWE-704
• CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the… CWE-704
• CVE-2026-6726 An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that… CWE-704
• CVE-2026-50337 Incorrect type conversion or cast in Windows Notification allows an authorized attacker… CWE-704
• CVE-2026-59871 node-tar is a tar archive manipulation library for Node.js. CWE-704