Russh is a Rust SSH client and server library. In versions prior to 0.62.4, a malicious SSH server that sends a malformed KEX_ECDH_REPLY containing a server_ephemeral value that is not 32 bytes long can cause the client’s Curve25519Kex::compute_shared_secret routine to panic. That routine forwards the decoded exchange.server_ephemeral value directly to clone_from_slice without validating its length, resulting in a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError. While the embedding process continues to run, the client session is lost, effectively denying service to the client before authentication.

The vulnerability affects the russh library from the Eugeny project. Any application linking russh versions earlier than 0.62.4 is subject to this issue. The bug was addressed in release v0.62.4, and the issue is resolved in that and later versions.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation to date. An attacker can trigger the panic by acting as an SSH server that sends a malformed KEX_ECDH_REPLY; the crash occurs before authentication and only terminates the client session, not the entire process. The exploitation requires a malicious server connection, making the attack vector an unauthenticated network connection from a compromised or malicious SSH server.