Vulnerability RUSTSEC-2026-0318

Unknown

2 days ago

Sending custom to-device messages may panics

0.1.0 - 0.18.0

Summary

Sending custom to-device messages may panics

Details

Using the IdentityBasedStrategy setting when calling Device::encrypt_event_raw or OlmMachine::encrypt_content_for_devices may cause a panic if the recipient does not have cross-signing keys.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

3 months ago

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

0.12.0 - 0.16.0 GHSA-wfq4-36m3-9g42

Unknown

4 months ago

Sender-binding gaps in to-device messages

0.12.0 - 0.16.0 RUSTSEC-2026-0159

Medium Risk

1 year ago

matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

0.8.0 - 0.11.0 RUSTSEC-2025-0041

Medium Risk

1 year ago

matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

0.8.0 - 0.11.0 GHSA-x958-rvg6-956w

Medium Risk

1 year ago

matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

0.1.0 - 0.7.2 GHSA-r5vf-wf4h-82gg

View all vulnerabilities for these packages

Impacted packages

matrix-sdk-crypto

Timeline

Published

2 days ago

Fixed (0.19.0)

15 days ago

Last Modified

6 hours ago