CVE-2026-24850 is a medium severity vulnerability in the RustCrypto ml-dsa crate affecting versions from 0.0.4 up to but not including 0.1.0-rc.4. The issue arises from an improper verification of cryptographic signatures due to a regression bug where the strict ordering check for hint indices was changed from '<' to '<=', allowing duplicate indices. This violates the ML-DSA specification (FIPS 204 / RFC 9881) which requires strictly increasing indices, potentially enabling attackers to forge or manipulate signatures. The vulnerability impacts the integrity of signature verification but does not affect confidentiality or availability. No known exploits are reported in the wild.
CVE-2026-23519 is a high-severity vulnerability in RustCrypto utils prior to version 0.4.4, where the conditional move CPU intrinsic (cmovnz) does not execute in constant time on the thumbv6m-none-eabi platform (Cortex M0, M0+, M1). This timing discrepancy can lead to observable side-channel leaks, potentially exposing sensitive information. The flaw arises because the compiler emits non-constant time assembly code, violating the constant-time guarantee critical for cryptographic operations. No known exploits are currently in the wild, but the vulnerability affects embedded systems using these RustCrypto utils on vulnerable platforms. The issue is fixed in version 0.4.4. European organizations using embedded devices with Cortex M0/M0+/M1 processors and RustCrypto utils versions before 0.
RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991.
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 PKE decryption path where an invalid elliptic-curve point (C1) is decoded and the resulting value is unwrapped without checking. Specifically, AffinePoint::from_encoded_point(&encoded_c1) may return a None/CtOption::None when the supplied coordinates are syntactically valid but do not lie on the SM2 curve. The calling code previously used .unwrap(), causing a panic when presented with such input. This issue has been patched via commit 085b7be.
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a critical vulnerability exists in the SM2 Public Key Encryption (PKE) implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. This reduces the security of the encryption from a 128-bit level to a trivial 16-bit level, allowing a practical attack to recover the nonce k and decrypt any ciphertext given only the public key and ciphertext. This issue has been patched via commit e4f7778.
The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.