sm2 (Rust Crate), Denial-of-Service Vulnerability, CVE-Not-Specified (Critical)

How the CVE Works

This critical vulnerability exists within the `sm2` Rust crate’s Public Key Encryption (PKE) decryption logic. During decryption, the library decodes the C1 field—an elliptic-curve point—from the ciphertext. It uses `AffinePoint::from_encoded_point()` to convert this decoded point. This function returns a `CtOption` (a constant-time Option) that will be `None` if the provided X and Y coordinates are syntactically valid 32-byte integers but do not mathematically lie on the expected SM2 curve. The vulnerable code in `src/pke/decrypting.rs` then calls `.unwrap()` on this result. When an attacker supplies crafted coordinates that are not on the curve, this `unwrap()` triggers a panic, crashing the process or thread and causing a Denial-of-Service (DoS). The `EncodedPoint::from_bytes()` validation only checks format and length, not mathematical curve membership, making the attack trivial to perform.

DailyCVE Form

Platform: Rust `sm2` crate
Version: Not specified
Vulnerability: Denial-of-Service
Severity: Critical
Date: Not specified

Prediction: 2026-04-10

What Undercode Say: Analytics

Bash commands and codes related to the blog

RUST_BACKTRACE=1 cargo run --example poc_der_invalid_point --features std

cargo run --example poc_der_invalid_point

How Exploit:

Craft ASN.1 DER ciphertext with invalid X/Y coordinates.

Submit to `DecryptingKey::decrypt_der()`.

Trigger panic on `.unwrap()` call.

Protection from this CVE

Replace `.unwrap()` with proper error handling.

Use match on `CtOption` result.

Return library `Err` for invalid points.

Impact:

Service crash (DoS).

Low attacker effort.

Widespread exposure risk.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin

Listen to this Post