crates.ioPackage

sm2

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-22700High 7.5
RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE
Affected: from 0.14.0-pre.0, through 0.14.0-rc.4.
Fixed in 0.14.0 (released Oct 2, 2026, 265 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.14.0, is not affected.
CVE-2026-22699High 7.5
RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()
Affected: from 0.14.0-pre.0, through 0.14.0-rc.4.
Fixed in 0.14.0 (released Oct 2, 2026, 265 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.14.0, is not affected.
CVE-2026-22698High 8.7
RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability
Affected: from 0.14.0-pre.0, through 0.14.0-rc.4.
Fixed in 0.14.0 (released Oct 2, 2026, 265 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.14.0, is not affected.