RUSTSEC-2026-0318 GHSA-45pr-7vv7-f64m
Sending custom to-device messages may panics
Not rated yet
crates.io
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.19.0- Upgrade matrix-sdk-crypto to this version or later
Description
Using the IdentityBasedStrategy setting when calling
Device::encrypt_event_raw or OlmMachine::encrypt_content_for_devices may
cause a panic if the recipient does not have cross-signing keys.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| matrix-sdk-crypto | >= 0.0.0-0, < 0.19.0 |
0.19.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
matrix-sdk-crypto crates.io → 0.19.0
- cargo
cargo update -p matrix-sdk-crypto --precise 0.19.0
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-wfq4-36m3-9g42 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution | Medium | Also affects matrix-sdk-crypto |
| GHSA-x958-rvg6-956w matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator | Medium | Also affects matrix-sdk-crypto |
| GHSA-4qg4-cvh2-crgg matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check | Medium | Also affects matrix-sdk-crypto |
| GHSA-9ggc-845v-gcgv matrix-sdk-crypto contains a log exposure of private key of the server-side key backup | Medium | Also affects matrix-sdk-crypto |
| GHSA-r5vf-wf4h-82gg matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity | Medium | Also affects matrix-sdk-crypto |
| GHSA-vp68-2wrm-69qm matrix-sdk-crypto contains potential impersonation via room key forward responses | High | Also affects matrix-sdk-crypto |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor