CVE-2023-28113 is a medium-severity (CVSS 5.9) Improper Input Validation vulnerability in russh. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for russh — see the affected versions and patch details below.
russh may use insecure Diffie-Hellman keys
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-28113.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
russh🦀russhReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality.
Details
Russh does not validate Diffie-Hellman keys.
It accepts received DH public keys $e$ where $e<0$, $e=1$, or $e \geq p-1$ from a misbehaving peer annd successfully performs key exchange.
This is a violation of RFC 4253, section 8 and RFC 8268, section 4, which state that:
DH Public Key values MUST be checked and both conditions:
- $1 < e < p-1$
- $1 < f < p-1$
MUST be true. Values not within these bounds MUST NOT be sent or accepted by either side. If either one of these conditions is violated, then the key exchange fails.
For example, a DH client public key $e=1$ would mean that the shared secret that the server calculates is always $K = e^y \mod{p} = 1^y \mod{p} = 1$. In other cases, an insecure order-2 subgroup may be used.
Also, the code does not look like it ensures that the generated secret key $y$ is in the valid interval $0 < y < q$ (or, if russh is the client, that the secret key $x$ satisfies $1 < x < q$):
https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76
For example, rng.gen_biguint() might return a number consisting of zeroes, so that $y = 0$.
The public key is not validated either: https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81
Impact
Due to the issues in the DH key generation, I think any connection that uses Diffie-Hellman key exchange is affected. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping.
Most other implementations reject such keys, so this is mainly an interoperability issue in such a case.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | russh | all versions | 0.36.2cargo update -p russh --precise 0.36.2 |
| 🦀crates.io | russh | ≥ 0.37.0&&< 0.37.1 | 0.37.1cargo update -p russh --precise 0.37.1 |
Affected Products
russhrussh_projectResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for russh, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update russh to 0.36.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-28113 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2023-28113 in your dependencies?
Find it across crates.io, including transitive dependencies.