CVE-2026-23519

Katalog CVE

CVSS 9.8 · Critical EPSS 0,56%

Kerentanan Observable Timing Discrepancy pada rustcrypto cmov. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp exploit · advisory vendor
• https://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778 patch