A critical denial of service vulnerability in the RustCrypto SM2 crate allows unauthenticated attackers to crash applications via malformed input.

This vulnerability occurs in the SM2 PKE decryption path when an invalid elliptic curve point is decoded and improperly unwrapped. Because the code fails to validate if the point lies on the SM2 curve, an unauthenticated attacker can trigger a panic and cause a service outage.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk due to the ease of exploitability. A successful attack results in application instability or complete service interruption, which can lead to significant downtime for systems relying on this cryptographic library for secure data processing.

Immediate Action: Developers must audit their dependencies and ensure that they are not utilizing the affected 0.14.0-pre.0 or 0.14.0-rc.0 versions of the SM2 crate, as no formal fix version is currently listed.

Proactive Monitoring: Security teams should monitor application logs for unexpected panics or crashes specifically occurring during cryptographic decryption operations.

Compensating Controls: Implement input validation layers at the application boundary to reject malformed cryptographic payloads before they reach the vulnerable decryption logic.

Public Exploit Available: Unknown.

Given the potential for service disruption, organizations using the RustCrypto SM2 library must prioritize identifying where these specific pre-release versions are deployed within their infrastructure. Because a formal patched release is not yet confirmed, developers should consider pinning to known stable versions or applying the upstream fix commit 085b7bee647029bd189e1375203418205006bcab manually to mitigate the risk of denial of service.