Denial of Service in RustCrypto: Elliptic Curves Affected by Invalid Point Handling

CVE-2026-22699

What is CVE-2026-22699?

A denial-of-service vulnerability was discovered in the RustCrypto: Elliptic Curves library affecting certain pre-release versions. This issue arises when an invalid elliptic curve point (C1) is provided during the decryption process of the SM2 PKE algorithm. Although the coordinates may appear valid syntactically, they do not lie on the SM2 curve. The flaw occurs in the AffinePoint::from_encoded_point function, which lacks proper validation, leading to panic via an unwrapped None value. The vulnerability has been addressed and patched in a subsequent commit.

References