CVE-2026-23965

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23965
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23965.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23965
Aliases
Published
2026-01-22T02:05:43.426Z
Modified
2026-03-14T12:47:18.312076Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
sm-crypto Affected by Signature Forgery in SM2-DSA
Details

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature forgery vulnerability exists in the SM2 signature verification logic of sm-crypto prior to version 0.4.0. Under default configurations, an attacker can forge valid signatures for arbitrary public keys. If the message space contains sufficient redundancy, the attacker can fix the prefix of the message associated with the forged signature to satisfy specific formatting requirements. Version 0.4.0 patches the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23965.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-347"
    ]
}
References

Affected packages

Git / github.com/juneandgreen/sm-crypto

Affected ranges

Type
GIT
Repo
https://github.com/juneandgreen/sm-crypto
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
85295a859d0766222d12ce2be3e6fce7b438b510

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23965.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "0.4.0"
            }
        ]
    }
]