Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

matrix-sdk-crypto

6 known vulnerabilities (1 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 high, 5 medium
Registry
crates.io

Advisories 6

  • CVE-2026-45056Medium 6.9

    Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

    Affected: from 0.12.0, fixed in 0.16.1.

  • CVE-2025-48937Medium 4.9

    matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

    Affected: from 0.8.0, fixed in 0.11.1.

  • CVE-2024-52813Medium 4.3

    matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

    Affected: fixed in 0.8.0; fixed in 0.8.0.

  • CVE-2024-40648Medium 5.4

    `UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk

    Affected: fixed in 0.7.2; fixed in 0.7.2.

  • CVE-2024-34353Medium 5.5

    matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

    Affected: from 0.7.0, fixed in 0.7.1.

  • When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder

    Affected: fixed in 0.6.0; fixed in 0.6.0.