The archive/CVE-2021-3634
libsshDisclosed 2021

CVE-2021-3634:libssh: SSH rekey digest size mismatch

A reconstruction of the flaw, and the evidence path Lachesis follows to make it visible.

Historical recordlibssh-0.9.5 (last-vulnerable)
WeaknessCWE-787 → CWE-125 · SSH rekey digest size mismatch
ImpactA ssh rekey digest size mismatch in libssh, reachable from attacker-controlled input.
Read the reconstruction
01What happened

With no family and no line seeded, the whole-taxonomy enumerator put its class-matched lead inside kex.c:732 (ssh_make_sessionid / rekey KEX digest handling) -- the.

That is the shape of the failure. The rest of this case file follows the evidence behind it.

Separate the record from the run

What was known.
What Lachesis established.

01Historical record

Known before Lachesis ran

The CVE and vulnerable release were selected from public history. We are not claiming novel discovery.

CVE
CVE-2021-3634
Vulnerable target
libssh-0.9.5 (last-vulnerable) · vulnerable
Prior knowledge
CVE-2021-3634 · libssh-0.9.5 (last-vulnerable) is vulnerable
then
02Lachesis run
Verified captured run

Independent re-detection

The experiment graph was built around the last-vulnerable release (libssh-0.9.5), scoped to src + include, so the vulnerable translation unit builds under the pass budget (build 25s, enrich 11056 nodes / 42359 edges), then enumerated BLIND over the whole constructor registry (no family hard-coded, no target line seeded). The census and candidate ids below are the enumerator's own verbatim output; prose in adjudication/trace is MY reading of the advisory + fix, clearly separated from tool output.

Seeded inputs
None
Run timestamp
2026-09-03T00:00:00Z
Evidence artifact
cve-2021-3634.kuzu (built from libssh libssh-0.9.5, scoped to src + include; graph + sidecars deleted after capture)

The commands and outputs below come from this recorded Lachesis run.

The reconstruction, in one frame

What Lachesis reconstructed.

One historical repository. Four captured queries. A complete source-to-sink argument.

Lachesis Casefiles · Unbound ComputeVerified runCVE-2021-3634
With no family and no line seeded, the whole-taxonomy enumerator put its class-matched lead inside kex.c:732.
01Sourceattacker-controlled input
02Sink/* rekey: secret_hash/session_id length inherited from the initial KEX digest size, not the rekey's */
03Missing guard/* rekey: secret_hash/session_id length inherited from the initial KEX digest size, not the rekey's */
$ lachesis sources_of → reaches → guard_dominance
libssh · libssh-0.9.5 (last-vulnerable) · vulnerableunboundcompute.com
This was known history. Your code is not.

Lachesis follows the same evidence path through unfamiliar repositories.

The Lachesis reconstruction

Here is how the path becomes visible.

These are the recorded questions Lachesis asked of the historical vulnerable code, followed by the raw result and source location each query returned.

Repositorylibssh
Revisionlibssh-0.9.5 (last-vulnerable) · vulnerable
EngineLachesis

Captured runA real replay of Lachesis over the graph we built for this case (build 25s under the pass cap, bounded memory). Every value below is verbatim captured tool output; the graph was released immediately after capture.

01 · lachesis01 / 03
Lachesis ran
lachesis build (scoped to src + include) && enrich

Investigate the candidate

The narrowed scope builds the vulnerable TU under the pass cap.

Captured resultCaptured · lachesis
raw captured outputlachesis
build rc=0 25s
enrich rc=0 :: pass2 published 11056 nodes and 42359 edges
kex.cline 0
Code location returned for this evidence step.
The repair

A small line with a large consequence.

the digest-length assumption is fixed at the initial KEX and not recomputed for the rekey's (possibly different-size) digest, so the length driving the hash copy no longer matches the destination buffer.

Before
/* rekey: secret_hash/session_id length inherited from the initial KEX digest size, not the rekey's */
After the patch
// 0.9.6 recomputes the digest/hash length for the rekey's negotiated KEX so secret_hash and session_id lengths always match the actual digest size.
Sources & further reading

The original record.

Read the historical advisory and vulnerability record behind this reconstruction.

Open the Lachesis quickstart