CVE-2026-22698 RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability

What is CVE-2026-22698?

CVE-2026-22698 is a high-severity vulnerability in RustCrypto elliptic-curves, published on 10 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a critical vulnerability exists in the SM2 Public Key Encryption (PKE) implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. This reduces the security of the encryption from a 128-bit level to a trivial 16-bit level, allowing a practical attack to recover the nonce k and decrypt any ciphertext given only the public key and ciphertext. This issue has been patched via commit e4f7778.

Weakness: CWE-331

Which versions are affected by CVE-2026-22698?

2 open source packages ship an affected version, including sm2. It affects 1 product.

Products include Rustcrypto Sm2 Elliptic Curve.

How do I fix CVE-2026-22698?

No fix has been published for CVE-2026-22698 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-22698 being exploited?

There is no known exploitation of CVE-2026-22698 in the wild and no public exploit code.

Other vulnerabilities in RustCrypto elliptic-curves

• CVE-2026-22699 RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() High 7.5
• CVE-2026-22700 RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w3g8-fp6j-wvqw.