CVE-2026-23519

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23519
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23519.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23519
Aliases
Related
Published
2026-01-15T19:13:54.440Z
Modified
2026-07-15T01:48:52.491412221Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz
Details

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23519.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-208"
    ]
}
References

Affected packages

Git / github.com/rustcrypto/utils

Affected ranges

Type
GIT
Repo
https://github.com/rustcrypto/utils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
24e51d8ae18507b71a2579c84e1f254587690daa
Fixed
55977257e7c82a309d5e8abfdd380a774f0f9778
Database specific 
{
    "cpe": "cpe:2.3:a:rustcrypto:cmov:*:*:*:*:*:rust:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.4"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

aarch64-dit-v0.*
aarch64-dit-v0.0.1-alpha
aarch64-dit-v0.1.0
base64ct-v0.*
base64ct-v0.1.0
base64ct-v0.1.1
base64ct-v0.1.2
base64ct-v0.2.0
base64ct-v0.2.1
base64ct-v1.*
base64ct-v1.0.0
base64ct-v1.0.1
blobby-v0.*
blobby-v0.1.0
blobby-v0.1.1
blobby-v0.1.2
blobby-v0.2.0
blobby-v0.3.0
blobby-v0.3.1
blobby-v0.4.0
blobby-v0.4.0-pre.0
blobby-v0.4.0-pre.1
block-buffe-v0.*
block-buffe-v0.10.2
block-buffer-v0.*
block-buffer-v0.10.0
block-buffer-v0.10.0-pre
block-buffer-v0.10.0-pre.1
block-buffer-v0.10.0-pre.2
block-buffer-v0.10.0-pre.3
block-buffer-v0.10.0-pre.4
block-buffer-v0.10.2
block-buffer-v0.10.3
block-buffer-v0.11.0
block-buffer-v0.11.0-pre
block-buffer-v0.11.0-pre.1
block-buffer-v0.11.0-pre.2
block-buffer-v0.11.0-pre.3
block-buffer-v0.11.0-pre.4
block-buffer-v0.11.0-pre.5
block-buffer-v0.11.0-rc.0
block-buffer-v0.11.0-rc.1
block-buffer-v0.11.0-rc.2
block-buffer-v0.11.0-rc.3
block-buffer-v0.11.0-rc.4
block-buffer-v0.11.0-rc.5
block-buffer-v0.5.0
block-buffer-v0.5.1
block-buffer-v0.6.0
block-buffer-v0.7.0
block-buffer-v0.7.1
block-buffer-v0.7.2
block-buffer-v0.7.3
block-buffer-v0.9.0
block-padding-v0.*
block-padding-v0.1.1
block-padding-v0.1.2
block-padding-v0.1.3
block-padding-v0.1.4
block-padding-v0.1.5
block-padding-v0.2.0
block-padding-v0.2.1
block-padding-v0.3.0
block-padding-v0.3.0-pre
block-padding-v0.3.1
block-padding-v0.3.3
block-padding-v0.4.0
block-padding-v0.4.0-pre.2
block-padding-v0.4.0-pre.3
block-padding-v0.4.0-pre.4
block-padding-v0.4.0-rc.0
block-padding-v0.4.0-rc.1
block-padding-v0.4.0-rc.2
block-padding-v0.4.0-rc.3
block-padding-v0.4.0-rc.4
block-padding-v0.4.1
block-padding-v0.4.2
byte-tools-v0.*
byte-tools-v0.3.0
byte-tools-v0.3.1
cmov-v0.*
cmov-v0.1.0
cmov-v0.1.1
cmov-v0.2.0
cmov-v0.3.0
cmov-v0.3.1
cmov-v0.4.0
cmov-v0.4.1
cmov-v0.4.2
cmov-v0.4.3
const-oid-v0.*
const-oid-v0.1.0
const-oid-v0.2.0
const-oid-v0.3.0
const-oid-v0.3.1
const-oid-v0.3.2
const-oid-v0.3.3
const-oid-v0.3.4
const-oid-v0.3.5
const-oid-v0.4.0
const-oid-v0.4.1
const-oid-v0.4.2
const-oid-v0.4.3
const-oid-v0.4.4
const-oid-v0.4.5
const-oid-v0.5.0
const-oid-v0.5.1
const-oid-v0.5.2
const-oid-v0.6.0
cpufeatures-v0.*
cpufeatures-v0.1.0
cpufeatures-v0.1.1
cpufeatures-v0.1.2
cpufeatures-v0.1.3
cpufeatures-v0.1.4
cpufeatures-v0.1.5
cpufeatures-v0.2.0
cpufeatures-v0.2.1
cpufeatures-v0.2.10
cpufeatures-v0.2.11
cpufeatures-v0.2.12
cpufeatures-v0.2.13
cpufeatures-v0.2.14
cpufeatures-v0.2.15
cpufeatures-v0.2.16
cpufeatures-v0.2.17
cpufeatures-v0.2.2
cpufeatures-v0.2.3
cpufeatures-v0.2.4
cpufeatures-v0.2.5
cpufeatures-v0.2.6
cpufeatures-v0.2.7
cpufeatures-v0.2.8
cpufeatures-v0.2.9
crypto-bigint-v0.*
crypto-bigint-v0.1.0
crypto-bigint-v0.2.0
crypto-bigint-v0.2.1
crypto-bigint-v0.2.2
crypto-bigint-v0.2.3
crypto-bigint-v0.2.4
crypto-bigint-v0.2.5
crypto-bigint-v0.2.6
crypto-bigint-v0.2.7
ctutils-v0.*
ctutils-v0.1.0
ctutils-v0.1.1
ctutils-v0.1.2
ctutils-v0.1.3
ctutils-v0.1.4
ctutils-v0.2.0
ctutils-v0.2.1
ctutils-v0.2.2
ctutils-v0.2.3
ctutils-v0.3.0
ctutils-v0.3.1
dbl-v0.*
dbl-v0.2.0
dbl-v0.2.1
dbl-v0.3.1
dbl-v0.3.2
dbl-v0.4.0
dbl-v0.4.0-pre.1
dbl-v0.4.0-pre.2
dbl-v0.4.0-pre.3
dbl-v0.4.0-pre.4
dbl-v0.4.0-rc.0
dbl-v0.4.0-rc.1
dbl-v0.4.0-rc.2
dbl-v0.5.0
der-v0.*
der-v0.1.0
der-v0.2.0
der-v0.2.0-pre
der-v0.2.1
der-v0.2.10
der-v0.2.2
der-v0.2.3
der-v0.2.4
der-v0.2.5
der-v0.2.6
der-v0.2.7
der-v0.2.8
der-v0.2.9
der-v0.3.0
der-v0.3.1
der-v0.3.2
der-v0.3.3
der-v0.3.4
der-v0.3.5
der-v0.4.0
der-v0.4.1
der_derive-v0.*
der_derive-v0.1.0
der_derive-v0.2.0
der_derive-v0.2.1
der_derive-v0.2.2
der_derive-v0.3.0
der_derive-v0.4.0
hex-literal-impl-v0.*
hex-literal-impl-v0.2.1
hex-literal-impl-v0.2.2
hex-literal-v0.*
hex-literal-v0.1.2
hex-literal-v0.1.3
hex-literal-v0.1.4
hex-literal-v0.2.0
hex-literal-v0.2.1
hex-literal-v0.3.0
hex-literal-v0.3.1
hex-literal-v0.3.2
hex-literal-v0.3.3
hex-literal-v0.3.4
hex-literal-v0.4.0
hex-literal-v0.4.1
hex-literal-v1.*
hex-literal-v1.0.0
hex-literal-v1.1.0
hybrid-array-v0.*
hybrid-array-v0.1.0
hybrid-array-v0.2.0-pre.0
hybrid-array-v0.2.0-pre.1
hybrid-array-v0.2.0-pre.2
hybrid-array-v0.2.0-pre.3
hybrid-array-v0.2.0-pre.4
hybrid-array-v0.2.0-pre.5
hybrid-array-v0.2.0-pre.6
hybrid-array-v0.2.0-pre.7
hybrid-array-v0.2.0-pre.8
hybrid-array-v0.2.0-rc.0
hybrid-array/v0.*
hybrid-array/v0.2.0-pre.0
inout-v0.*
inout-v0.1.0
inout-v0.1.1
inout-v0.1.2
inout-v0.1.3
inout-v0.2.0
inout-v0.2.0-pre.1
inout-v0.2.0-pre.2
inout-v0.2.0-pre.4
inout-v0.2.0-rc.0
inout-v0.2.0-rc.1
inout-v0.2.0-rc.2
inout-v0.2.0-rc.3
inout-v0.2.0-rc.4
inout-v0.2.0-rc.5
inout-v0.2.0-rc.6
inout-v0.2.1
inout-v0.2.2
opaque-debug-v0.*
opaque-debug-v0.2.1
opaque-debug-v0.2.2
opaque-debug-v0.3.0
opaque-debug-v0.3.1
opaque-debug_v0.*
opaque-debug_v0.1.0
opaque-debug_v0.2.0
opaque-debug_v0.2.1
pem-rfc7468-v0.*
pem-rfc7468-v0.1.0
pem-rfc7468-v0.1.1
pem-rfc7468-v0.2.0
pkcs1-v0.*
pkcs1-v0.1.0
pkcs1-v0.1.1
pkcs1-v0.2.0
pkcs1-v0.2.1
pkcs1-v0.2.2
pkcs1-v0.2.3
pkcs5-v0.*
pkcs5-v0.1.0
pkcs5-v0.1.1
pkcs5-v0.2.0
pkcs5-v0.2.1
pkcs5-v0.2.2
pkcs5-v0.3.0
pkcs5-v0.3.1
pkcs8-v0.*
pkcs8-v0.1.0
pkcs8-v0.1.1
pkcs8-v0.2.0
pkcs8-v0.2.1
pkcs8-v0.2.2
pkcs8-v0.3.0
pkcs8-v0.3.1
pkcs8-v0.3.2
pkcs8-v0.3.3
pkcs8-v0.4.0
pkcs8-v0.4.0-pre
pkcs8-v0.4.1
pkcs8-v0.5.0
pkcs8-v0.5.1
pkcs8-v0.5.2
pkcs8-v0.5.3
pkcs8-v0.5.4
pkcs8-v0.5.5
pkcs8-v0.6.0
pkcs8-v0.6.1
pkcs8-v0.7.0
pkcs8-v0.7.1
pkcs8-v0.7.2
pkcs8-v0.7.3
pkcs8-v0.7.4
pkcs8-v0.7.5
spki-v0.*
spki-v0.1.0
spki-v0.2.1
spki-v0.3.0
spki-v0.4.0
wycheproof2blb-v0.*
wycheproof2blb-v0.1.0
zeroize-v1.*
zeroize-v1.4.3
zeroize-v1.5.0
zeroize-v1.5.0-pre
zeroize-v1.5.1
zeroize-v1.5.2
zeroize-v1.5.3
zeroize-v1.5.4
zeroize-v1.5.5
zeroize-v1.5.6
zeroize-v1.5.7
zeroize-v1.6.0
zeroize-v1.6.1
zeroize-v1.7.0
zeroize-v1.8.0
zeroize-v1.8.1
zeroize_derive-v1.*
zeroize_derive-v1.2.1
zeroize_derive-v1.2.2
zeroize_derive-v1.3.0
zeroize_derive-v1.3.0-pre
zeroize_derive-v1.3.1
zeroize_derive-v1.3.2
zeroize_derive-v1.3.3
zeroize_derive-v1.4.0
zeroize_derive-v1.4.1
zeroize_derive-v1.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23519.json"