CVE-2026-102824Medium· 4.3▾ SunlitRussh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secr…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
russh < 0.63.0Patched in:
russh 0.63.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102825Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-102821Medium· 6.5Russh is a Rust SSH client and server library
CVE-2026-102823High· 7.5Russh is a Rust SSH client and server library
CVE-2026-102820Medium· 6.2pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance
CVE-2026-102822Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-111062LowA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request