juneandgreen/sm-crypto · Security
sm-crypto Affected by Signature Malleability in SM2-DSA
- GHSA ID
- GHSA-qv7w-v773-3xqm
- CVE ID
- CVE-2026-23967
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Summary
A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library. An attacker can derive a new valid signature for a previously signed message from an existing signature.
Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab
- Atuin Automated Vulnerability Discovery Engine
CWEs
- CWE-347 · Improper Verification of Cryptographic Signature