CVE-2026-22698

216.73.216.233

· Published 10/01/2026 06:15 · Modified 10/01/2026 06:15

Labels: CVE-2026-22698 2026-01-10 CVE-2026-22698 CWE-331 [email protected]

Essential information

Published: 10/01/2026 06:15
Modified: 10/01/2026 06:15
Author: —
Creator: —
CVSS: 8.7 HIGH (v3) 8.7 HIGH (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a critical vulnerability exists in the SM2 Public Key Encryption (PKE) implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. This reduces the security of the encryption from a 128-bit level to a trivial 16-bit level, allowing a practical attack to recover the nonce k and decrypt any ciphertext given only the public key and ciphertext. This issue has been patched via commit e4f7778.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
rustcrypto / elliptic curves	`cpe:2.3:a:rustcrypto:elliptic_curves:0.14.0-pre.0:::::::*`
rustcrypto / elliptic curves	`cpe:2.3:a:rustcrypto:elliptic_curves:0.14.0-rc.0:::::::*`