{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-07-02T18:01:56.014","vulnerabilities":[{"cve":{"id":"CVE-2026-22698","sourceIdentifier":"security-advisories@github.com","published":"2026-01-10T06:15:52.220","lastModified":"2026-06-17T10:20:15.333","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a  critical vulnerability exists in the SM2 Public Key Encryption (PKE) implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. This reduces the security of the encryption from a 128-bit level to a trivial 16-bit level, allowing a practical attack to recover the nonce k and decrypt any ciphertext given only the public key and ciphertext. This issue has been patched via commit e4f7778."},{"lang":"es","value":"RustCrypto: Curvas Elípticas es soporte de Criptografía de Curva Elíptica (ECC) de propósito general, incluyendo tipos y rasgos para representar varias formas de curvas elípticas, escalares, puntos y claves públicas/secretas compuestas de ellos. En las versiones 0.14.0-pre.0 y 0.14.0-rc.0, existe una vulnerabilidad crítica en la implementación de Cifrado de Clave Pública (PKE) SM2 donde el nonce efímero k se genera con una entropía severamente reducida. Un error de desajuste de unidades hace que la función de generación de nonce solicite solo 32 bits de aleatoriedad en lugar de los 256 bits esperados. Esto reduce la seguridad del cifrado de un nivel de 128 bits a un nivel trivial de 16 bits, permitiendo un ataque práctico para recuperar el nonce k y descifrar cualquier texto cifrado dado solo la clave pública y el texto cifrado. Este problema ha sido parcheado a través del commit e4f7778."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"RustCrypto","product":"elliptic-curves","versions":[{"version":"= 0.14.0-pre.0","status":"affected"},{"version":"= 0.14.0-rc.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-12T16:47:49.756087Z","id":"CVE-2026-22698","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-331"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rustcrypto:sm2_elliptic_curve:0.14.0:pre0:*:*:*:rust:*:*","matchCriteriaId":"5F5BCFE9-1585-4A90-857F-7F9E1B9C9ADA"},{"vulnerable":true,"criteria":"cpe:2.3:a:rustcrypto:sm2_elliptic_curve:0.14.0:rc0:*:*:*:rust:*:*","matchCriteriaId":"B584C50F-8ED4-45F4-8799-7CCFE8D4DF66"}]}]}],"references":[{"url":"https://crates.io/crates/sm2/0.14.0-pre.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://crates.io/crates/sm2/0.14.0-rc.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/RustCrypto/elliptic-curves/commit/4781762f23ff22ab34763410f648128055c93731","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/RustCrypto/elliptic-curves/commit/e4f77788130d065d760e57fb109370827110a525","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/RustCrypto/elliptic-curves/pull/1600","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-w3g8-fp6j-wvqw","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]}]}}]}