CVE-2026-73429: eugeny russh Incorrect Type Conversion or Cast

Vulnerability summary

CVE-2026-73429 is a medium (CVSS 5.3) Incorrect Type Conversion or Cast vulnerability in eugeny russh. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities.

Timeline

1. 12-08-2026
   PublishedVulnerability first disclosed.
2. 14-08-2026
   Last modifiedVulnerability information updated.

Description

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.

• CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.
• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.