CVE-2026-23967: sm-crypto Affected by Signature Malleability in SM2-DSA

January 21, 2026 (updated January 22, 2026)

A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library. An attacker can derive a new valid signature for a previously signed message from an existing signature.

References

github.com/JuneAndGreen/sm-crypto
github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-qv7w-v773-3xqm
github.com/advisories/GHSA-qv7w-v773-3xqm
nvd.nist.gov/vuln/detail/CVE-2026-23967

Code Behaviors & Features

Detect and mitigate CVE-2026-23967 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →