CVE-2026-22698 — HIGH (7.5)

Vulnerability Description

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a critical vulnerability exists in the SM2 Public Key Encryption (PKE) implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. This reduces the security of the encryption from a 128-bit level to a trivial 16-bit level, allowing a practical attack to recover the nonce k and decrypt any ciphertext given only the public key and ciphertext. This issue has been patched via commit e4f7778.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Rustcrypto	Sm2 Elliptic Curve	0.14.0

Related Weaknesses (CWE)

CWE-331

References

https://crates.io/crates/sm2/0.14.0-pre.0Release Notes
https://crates.io/crates/sm2/0.14.0-rc.0Release Notes
https://github.com/RustCrypto/elliptic-curves/commit/4781762f23ff22ab34763410f64Patch
https://github.com/RustCrypto/elliptic-curves/commit/e4f77788130d065d760e57fb109Patch
https://github.com/RustCrypto/elliptic-curves/pull/1600Issue TrackingPatch
https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-w3g8-fp6jExploitMitigationVendor Advisory

FAQ

What is CVE-2026-22698?

CVE-2026-22698 is a vulnerability with a CVSS score of 7.5 (HIGH). RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret k...

How severe is CVE-2026-22698?

CVE-2026-22698 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-22698?

Check the references section above for vendor advisories and patch information. Affected products include: Rustcrypto Sm2 Elliptic Curve.