CVE-2026-23966criticalCWE-345

CVE-2026-23966: fallo crítico en JuneAndGreen sm-crypto

sm-crypto Affected by Private Key Recovery in SM2-PKE

Publicada el

Seguir esta CVE+ Monitorear sm-crypto+ Monitorear sm-crypto

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.2%
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
JuneAndGreen · sm-crypto
CVEs relacionadas — JuneAndGreen sm-crypto

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-73567CRITICALsm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clockEPSS 0.4%CVE-2026-23965HIGHsm-crypto Affected by Signature Forgery in SM2-DSAEPSS 0.2%CVE-2026-23967HIGHsm-crypto Affected by Signature Malleability in SM2-DSAEPSS 0.2%