CVE-2026-102824

Deferred Deferred - Pending Action

Hybrid Key Exchange Bypass in Russh Library

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102824

EUVD

EUVD-2026-89207

Affected Vendors & Products

Vendor	Product	Version / Range
russh	russh	to 0.63.0 (exc)
eugeny	russh	to 0.63.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Russh SSH library before version 0.63.0. It involves the hybrid ML-KEM 768 and X25519 key exchange implementation. A malicious SSH peer can send an all-zero 32-byte X25519 public key, which forces the X25519 contribution to the shared secret to zero. This reduces the hybrid key exchange to only ML-KEM, weakening the intended fallback protection if ML-KEM is compromised.

Detection Guidance

To detect this vulnerability, check if your system uses russh library versions prior to 0.63.0. Inspect the library version in use and compare it against the fixed version. No specific commands are provided in the context to actively detect exploitation attempts.

Impact Analysis

An attacker could exploit this to downgrade the security of SSH key exchanges. If ML-KEM is later weakened, systems using affected Russh versions could face increased risk of unauthorized access. The impact is limited but reduces defense-in-depth security.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it pertains to data protection and encryption standards rather than regulatory frameworks. However, it weakens cryptographic key exchange security, which could indirectly affect compliance if encryption is a requirement for safeguarding sensitive data under these regulations.

Mitigation Strategies

Immediately upgrade the russh library to version 0.63.0 or later. This version includes checks to reject low-order points like all-zero X25519 public keys, preventing the vulnerability. Review key exchange configurations to ensure hybrid ML-KEM and X25519 implementations are properly validated.

Hi! I’m here to help you understand CVE-2026-102824. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70