CVE-2026-23966criticalCWE-345

CVE-2026-23966: falha crítica em JuneAndGreen sm-crypto

sm-crypto Affected by Private Key Recovery in SM2-PKE

Publicada em

Seguir esta CVE+ Monitorar sm-crypto+ Monitorar sm-crypto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.2%
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
JuneAndGreen · sm-crypto
CVEs relacionadas — JuneAndGreen sm-crypto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73567CRITICALsm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clockEPSS 0.4%CVE-2026-23965HIGHsm-crypto Affected by Signature Forgery in SM2-DSAEPSS 0.2%CVE-2026-23967HIGHsm-crypto Affected by Signature Malleability in SM2-DSAEPSS 0.2%