CVE-2026-128087

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kexdone with the raw shared secret before checkserverkey accepts the server host key or certificate. A...

CVE-2026-128087 russh kex_done: shared-secret callback runs before server host-key verification

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kexdone with the raw shared secret before checkserverkey accepts the server host key or certificate. A...