CVE-2026-23966: sm-crypto Affected by Private Key Recovery in SM2-PKE

January 21, 2026 (updated January 22, 2026)

A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions.

References

github.com/JuneAndGreen/sm-crypto
github.com/JuneAndGreen/sm-crypto/commit/b1c824e58fdf1eaa73692c124a095819a8c45707
github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v
github.com/advisories/GHSA-pgx9-497m-6c4v
nvd.nist.gov/vuln/detail/CVE-2026-23966

Code Behaviors & Features

Detect and mitigate CVE-2026-23966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →