The RustCrypto SM2 library contains a critical denial-of-service vulnerability in versions 0.14.0-pre.0 and 0.14.0-rc.0 that allows remote attackers to crash the calling process.

The vulnerability is an improper input validation flaw (CWE-20) where the decrypt function performs unchecked operations on input buffers. An unauthenticated attacker can exploit this by submitting undersized or malformed ciphertext, causing the application to panic and terminate.

The exploitation of this flaw leads to service unavailability, as the process or thread handling the cryptographic operation will crash. With a CVSS score of 7.5, the vulnerability is classified as High severity, primarily due to the ease of exploitation by unauthenticated remote actors. Frequent crashes of critical services could result in significant business disruption and loss of availability for systems relying on this library for secure communication.

Immediate Action: Review the project dependencies and ensure the use of the patched version if available, or pin to a known secure version while monitoring the repository for the release of a stable fix.

Proactive Monitoring: Monitor application logs for frequent panics or unexpected thread terminations, particularly those occurring during cryptographic decryption routines.

Compensating Controls: Implement input validation at the application boundary to reject malformed ciphertext or undersized payloads before they reach the SM2 decryption logic.

Public Exploit Available: Unknown.

Given the potential for remote denial-of-service, organizations utilizing the RustCrypto SM2 crate must prioritize the identification of affected versions within their codebase. While the specific fix is available via commit e60e991, users should track the upstream repository for an official crate update to ensure long-term stability and security. Immediate mitigation via input sanitization is recommended until a formal dependency update can be applied.