11 matches found
GHSA-W3JG-PJXF-73P4 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...
EUVD-2026-89207
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange...
DEBIAN-CVE-2026-102824
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
CVE-2026-102824
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
UBUNTU-CVE-2026-102824
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
CVE-2026-102824
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
CVE-2026-102824 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
CVE-2026-102824 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...
CVE-2026-102824
The Russh Rust SSH client and server library (prior to version 0.63.0 ) contains a vulnerability in the hybrid ML-KEM 768 and X25519 key exchange implementation. The root cause is a missing zero-point validation in russh/src/kex/hybrid_mlkem.rs, which allows the library to accept an all-zero 32-b...
CVE-2026-102824 Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...