CVE-2026-73430

The CVSS 5.3 rating mischaracterizes CVE-2026-73430 as a moderate flaw. The vulnerability is trivially repeatable by any connecting client before authentication — an attacker can crash worker tasks at will, potentially exhausting server capacity even when individual crashes don't halt the entire process. The pre-authentication trigger and crashable-at-will attack surface reveals an architectural failure in russh's key exchange pipeline. The vulnerability isn't simply that `encode_mpint` panics on zero-length input. It's that three components fail in sequence without any catching the invalid state. `Curve25519Kex::server_dh` accepts an all-zero Q_C without validating that the peer public key is a valid Curve25519 point — a check explicitly required by RFC 5656. This results in an all-zero shared secret, which is mathematically possible but cryptographically meaningless. The downstream `compute_exchange_hash` then passes this to `encode_mpint`, which expects non-zero leading bytes to skip. The function's logic assumes well-formed input and doesn't guard against the degenerate case where all bytes are zero-valued leading bytes, resulting in an out-of-bounds index. This matters because the fix wasn't isolated to one function — it required changes across this call chain, suggesting the root issue is systemic: russh's key exchange path trusts peer input without validating cryptographic constraints before processing. Each component was individually reasonable but collectively unsafe. Two concrete questions should guide your response. First, verify whether version 0.62.4 adds validation at the Curve25519Kex entry point (rejecting zero or invalid public keys before computation) or only hardens encode_mpint — these represent fundamentally different security postures. Second, audit analogous input validation gaps in other code paths: Ed25519 key exchange, ECDH, RSA kex implementations, and client-side message processing. The 2023 patch (CVE-2023-46121) addressed missing DH parameter validation in GEX requests; this 2024 patch addresses ECDH initiation. Both failures follow the identical lineage — peer input enters the kex pipeline without cryptographic constraint checking, propagates through multiple functions that each assume well-formedness, and surfaces as a crash downstream. Production systems embedding russh as their SSH layer have been living with this gap as an architectural assumption. The question is whether similar validation gaps exist in other code paths that haven't been explicitly audited — and whether this patch represents a targeted fix or the beginning of a broader security review of the kex pipeline's assumptions about input validity.

Reviewed through automated stages and approved by a human before publication.