CVE-2026-23967highCWE-347

CVE-2026-23967: falha de alta gravidade em JuneAndGreen sm-crypto

sm-crypto Affected by Signature Malleability in SM2-DSA

Publicada em

Seguir esta CVE+ Monitorar sm-crypto+ Monitorar sm-crypto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.2%
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
JuneAndGreen · sm-crypto
CVEs relacionadas — JuneAndGreen sm-crypto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73567CRITICALsm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clockEPSS 0.4%CVE-2026-23966CRITICALsm-crypto Affected by Private Key Recovery in SM2-PKEEPSS 0.2%CVE-2026-23965HIGHsm-crypto Affected by Signature Forgery in SM2-DSAEPSS 0.2%