{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102824", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T17:25:25.265Z", "datePublished": "2026-09-29T18:27:41.650Z", "dateUpdated": "2026-09-30T20:24:58.381Z"}, "containers": {"cna": {"title": "Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange", "problemTypes": [{"descriptions": [{"cweId": "CWE-327", "lang": "en", "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4"}, {"name": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c"}, {"name": "https://github.com/Eugeny/russh/releases/tag/v0.63.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.0"}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"version": "< 0.63.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T18:27:41.650Z"}, "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0."}], "source": {"advisory": "GHSA-w3jg-pjxf-73p4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T20:24:54.936526Z", "id": "CVE-2026-102824", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:24:58.381Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102824", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T20:24:54.936526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:09:35.101Z"}}], "cna": {"title": "Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange", "source": {"advisory": "GHSA-w3jg-pjxf-73p4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Eugeny", "product": "russh", "versions": [{"status": "affected", "version": "< 0.63.0"}]}], "references": [{"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4", "name": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c", "name": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Eugeny/russh/releases/tag/v0.63.0", "name": "https://github.com/Eugeny/russh/releases/tag/v0.63.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T18:27:41.650Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102824", "state": "PUBLISHED", "dateUpdated": "2026-09-30T20:24:58.381Z", "dateReserved": "2026-09-29T17:25:25.265Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-29T18:27:41.650Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "russh", "vendor": "Eugeny", "versions": [{"status": "affected", "version": "< 0.63.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0."}], "id": "CVE-2026-102824", "lastModified": "2026-09-30T21:17:05.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102824", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T20:24:54.936526Z", "version": "2.0.3"}}]}, "published": "2026-09-29T19:17:24.543", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/releases/tag/v0.63.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "russh: russh: Cryptographic fallback bypass via missing public key validation", "id": "2543498", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543498"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-358", "details": ["A flaw was found in russh. The library fails to validate peer public keys during hybrid cryptographic key exchange, accepting an all-zero key. A remote attacker acting as a malicious Secure Shell (SSH) peer can exploit this flaw during connection negotiation to force the classical encryption component of the shared secret to zero. This causes the connection to rely entirely on post-quantum algorithms, undermining the intended fallback protection of the hybrid exchange and weakening session security."], "name": "CVE-2026-102824", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-29T18:27:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102824\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102824\nhttps://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.0\nhttps://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4"], "threat_severity": "Moderate"}