GHSA-j9xq-69pf-pcm8
High · 7.5CVSS
7.5
EPSS
—
Published
Jan 13, 2026
CISA due date
—
The record
RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | sm2 | 0.14.0-pre.0 | No fix |
| cargo | sm2 | 0.14.0-pre.0 | No fix |
Related vulnerabilities
- CVE-2026-22700 RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support… Same vulnerability
- CVE-2026-22698 RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support… Also affects sm2
- GHSA-78p6-6878-8mj6 SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() Also affects sm2
- GHSA-w3g8-fp6j-wvqw SM2-PKE has 32-bit Biased Nonce Vulnerability Also affects sm2
- CVE-2026-22699 SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() Also affects sm2
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20