Improper Check for Unusual or Exceptional Conditions Affecting russh package, versions <0.62.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-RUSSH-18307426
- published25 Jul 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-704 (opens in a new tab)How to fix?
Upgrade russh to version 0.62.4 or higher.
Overview
Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the compute_shared_secret function. An attacker can cause a client session to terminate unexpectedly by sending a malformed key-exchange reply with an incorrect ephemeral key length during the SSH handshake. This can be exploited by a malicious server or a man-in-the-middle attacker before authentication is completed.
Workaround
This vulnerability can be mitigated by disabling curve25519-sha256 in the preferred key exchange algorithms and using alternatives that validate peer-ephemeral lengths.