fkie_cve-2026-102824

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.

GHSA-w3jg-pjxf-73p4 — Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Affected: crates.io: russh

## Vulnerability

The hybrid ML-KEM 768 + X25519 key exchange implementation in `russh/src/kex/hybrid_mlkem.rs` does not validate that the remote peer's X25519 public key is not the zero point (all-zero 32-byte value). This allows a remote peer to force the X25519 contribution to the combined shared secret to zero, reducing the hybrid KEX to a single-algorithm exchange.

Affected code at HEAD (v0.62.4, commit 0089c89):

**Server-side** (`server_dh`, lines 92-93): ```rust let mut c_pk1 = MontgomeryPoint([0; 32]); c_pk1.0.copy_from_slice(c_pk1_bytes); // No zero-point check - proceeds to: let k_cl = s_secret * c_pk1; ```

**Client-side** (`compute_shared_secret`, lines 154-155): ```rust let mut s_pk1 = MontgomeryPoint([0; 32]); s_pk1.0.copy_from_slice(s_pk1_bytes); // No zero-point check - proceeds to: let k_cl = x25519_secret * s_pk1; ```

## Root Cause

Commit a7fc1eb (2026-07-22, "fix mpint encoding and validate curve25519 keys") added zero-point validation to the standalone Curve25519 KEX in `russh/src/kex/curve25519.rs` at two locations: - `server_dh` line 77: `if client_pubkey.0 == [0u8; 32] { return Err(crate::Error::Kex); }` - `compute_shared_secret` line 122: `if remote_pubkey.0 == [0u8; 32] { return Err(crate::Error::Kex); }`

The same X25519 scalar multiplication pattern appears in `hybrid_mlkem.rs`, but the fix was not applied there.

## Proof of Concept

A malicious SSH client negotiating `mlkem768x25519-sha256` can send a KEX_HYBRID_INIT message containing a vali…

Most recent entries from all

fkie_cve-2026-102824

GHSA-w3jg-pjxf-73p4 — Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange