Denial-of-Service Vulnerability in RustCrypto Elliptic Curves
CVE-2026-22700

7.5HIGH

Key Information:

Vendor

Rustcrypto

Status
Elliptic-curves
Vendor
CVE Published:
10 January 2026

What is CVE-2026-22700?

A denial-of-service vulnerability exists in the SM2 public-key encryption implementation within RustCrypto's Elliptic Curves library. Specifically, versions 0.14.0-pre.0 and 0.14.0-rc.0 are at risk due to unchecked operations during the decryption process. An attacker can exploit this by sending inadequately sized ciphertext or crafted DER-encoded structures, potentially triggering bounds-check panics which may crash the calling thread or process. The issue has been addressed in later patches.

Affected Version(s)

elliptic-curves = 0.14.0-pre.0 = 0.14.0-pre.0

elliptic-curves = 0.14.0-rc.0 = 0.14.0-rc.0

References

https://github.com/RustCrypto/elliptic-curves/security/ad...
x_refsource_CONFIRM
https://github.com/RustCrypto/elliptic-curves/pull/1603
x_refsource_MISC
https://github.com/RustCrypto/elliptic-curves/commit/e60e...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.