Russh, a Rust SSH client and server library, has a flaw in its hybrid ML‑KEM 768 and X25519 key exchange. The library accepts a 32‑byte all‑zero X25519 public key from a peer, which forces the X25519 contribution in the combined shared secret to zero. A malicious SSH peer can therefore force the shared secret to depend solely on the ML‑KEM component, defeating the intended fallback protection and allowing future weaknesses in ML‑KEM to compromise confidentiality.

The vulnerability affects all releases of the russh library before version 0.63.0, as distributed by the Eugeny maintainers.

The CVSS score is 4.3, indicating a moderate severity, and the EPSS score is unavailable. The issue is not listed in the CISA KEV catalog. The attack requires an attacker to establish an SSH session with a system that uses the vulnerable russh library, making the likely attack vector remote via SSH. No public exploit has been reported, but the flaw reduces the robustness of the key exchange and could facilitate a downgrade or compromise if the ML‑KEM algorithm is weakened.