RustCrypto elliptic-curves 0.14.0-pre.0/0.14.0-rc.0 unwrap denial of service

Summaryinfo

A vulnerability classified as problematic was found in RustCrypto elliptic-curves 0.14.0-pre.0/0.14.0-rc.0. Affected by this issue is the function unwrap. Executing a manipulation can lead to denial of service. This vulnerability is handled as CVE-2026-22699. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in RustCrypto elliptic-curves 0.14.0-pre.0/0.14.0-rc.0. It has been declared as problematic. This vulnerability affects the function unwrap. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 PKE decryption path where an invalid elliptic-curve point (C1) is decoded and the resulting value is unwrapped without checking. Specifically, AffinePoint::from_encoded_point(&encoded_c1) may return a None/CtOption::None when the supplied coordinates are syntactically valid but do not lie on the SM2 curve. The calling code previously used .unwrap(), causing a panic when presented with such input. This issue has been patched via commit 085b7be.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-22699 since 01/08/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Applying the patch 085b7bee647029bd189e1375203418205006bcab is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-1875). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• RustCrypto

Name

• elliptic-curves

Version

• 0.14.0-pre.0
• 0.14.0-rc.0

License

• open-source

Website

• Product: https://github.com/RustCrypto/elliptic-curves/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion