matrix-sdk-crypto (crates.io)
Advisories
12
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.19.0 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p matrix-sdk-crypto --precise 0.19.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| RUSTSEC-2026-0318 Sending custom to-device messages may panics |
Not rated yet | >= 0.0.0-0, < 0.19.0 | 0.19.0 |
| GHSA-wfq4-36m3-9g42 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution |
Medium EPSS 0.31% |
>= 0.12.0, < 0.16.1 | 0.16.1 |
| GHSA-wfq4-36m3-9g42 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution |
Medium EPSS 0.31% |
>= 0.12.0, < 0.16.1 | 0.16.1 |
| GHSA-x958-rvg6-956w matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator |
Medium EPSS 0.37% |
>= 0.8.0, < 0.11.1 | 0.11.1 |
| GHSA-x958-rvg6-956w matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator |
Medium EPSS 0.37% |
>= 0.8.0, < 0.11.1 | 0.11.1 |
| GHSA-4qg4-cvh2-crgg matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check |
Medium EPSS 0.28% |
< 0.7.2 | 0.7.2 |
| GHSA-4qg4-cvh2-crgg matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check |
Medium EPSS 0.28% |
>= 0.0.0-0, < 0.7.2 | 0.7.2 |
| GHSA-9ggc-845v-gcgv matrix-sdk-crypto contains a log exposure of private key of the server-side key backup |
Medium EPSS 0.19% |
>= 0.7.0, < 0.7.1 | 0.7.1 |
| GHSA-r5vf-wf4h-82gg matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity |
Medium EPSS 0.49% |
>= 0.0.0-0, < 0.8.0 | 0.8.0 |
| GHSA-r5vf-wf4h-82gg matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity |
Medium EPSS 0.49% |
< 0.8.0 | 0.8.0 |
| GHSA-vp68-2wrm-69qm matrix-sdk-crypto contains potential impersonation via room key forward responses |
High EPSS 0.63% |
< 0.6.0 | 0.6.0 |
| GHSA-vp68-2wrm-69qm matrix-sdk-crypto contains potential impersonation via room key forward responses |
High EPSS 0.63% |
>= 0.0.0-0, < 0.6.0 | 0.6.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor