CVE-2026-128087

Name of the Vulnerable Software and Affected Versions russh versions 0.55.0 through 0.65.0

Description During the initial key exchange, the library invokes the client::Handler::kex done() callback with the raw shared secret before the check server key() function validates the server host key or certificate. A malicious SSH server can exploit this sequence to trigger application-defined secondary-channel initialization or early data handling, even if the server identity is subsequently rejected. This affects applications that use the kex done() callback for protocol-bridging purposes, such as initializing VPN-over-SSH, UDP data planes, or custom enterprise transports, potentially exposing early data or causing the application to act on a session established with an untrusted peer.

Recommendations Update russh to version 0.65.1. As a temporary workaround, ensure that any actions derived from the kex done() callback are deferred until the server trust is confirmed via check server key().