sm-crypto Affected by Private Key Recovery in SM2-PKE

GHSA-pgx9-497m-6c4v · CVE-2026-23966

Published Jan 21, 2026 · Modified Feb 3, 2026

Description

Summary

A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions.

Credit

This vulnerability was discovered by:

XlabAI Team of Tencent Xuanwu Lab
Atuin Automated Vulnerability Discovery Engine

References

WEB https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23966
WEB https://github.com/JuneAndGreen/sm-crypto/commit/b1c824e58fdf1eaa73692c124a095819a8c45707
PACKAGE https://github.com/JuneAndGreen/sm-crypto

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes