https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:50:18.507205+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-73429 CVE-2026-73429 — Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) 2026-10-08T08:50:18.509444+00:00

Affected: Eugeny russh

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.