EUVD-2026-89012
GHSA-9qr7-mmm2-9f2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify service performing SM2 signatures
-
DeliveryTrigger many signing operations remotely
-
ExploitMeasure response timing variations
-
ExecutionStatistically recover secret scalar bits
-
ImpactReconstruct SM2 private key
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Timing attack prevention
|
| Exploitation Conditions | Exploitation requires the target to actively perform SM2 (Chinese GM standard) signature generation using a vulnerable OpenSSL version (1.1.1 <1.1.1zj, 3.0 <3.0.23, 3.4 <3.4.8, 3.5 <3.5.9, 3.6 <3.6.5, or 4.0 <4.0.3). SM2 is a regionally-specific algorithm, so deployments not using SM2 signatures are unaffected - this sharply narrows real-world exposure despite OpenSSL's ubiquity. The attack is further limited by the need for a high volume of precisely-measured signing operations over a low-jitter network path (reflected in AC:H), making it a targeted, resource-intensive effort rather than a drive-by attack. |
| Impact | This is a genuinely low-priority issue despite affecting ubiquitous software. The vendor CVSS of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a timing side-channel (CWE-208) in SM2 signature generation - a class of flaw that is network-reachable in principle but requires many precise timing measurements (AC:H) and yields only partial confidentiality impact (C:L). All threat-intel signals corroborate the low rating and none conflict: SSVC decision is Exploitation=none, Automatable=no, Technical Impact=partial, meaning CISA's framework points to no track/monitoring rather than act. There is no EPSS score provided, no CISA KEV listing, and no public exploit code. The signals are internally consistent - a high-CVSS-but-low-real-risk situation does not apply here because the CVSS itself is already low. The main caveat is that side-channel key-recovery attacks, while difficult and requiring co-location or a low-jitter path plus a large sample of signing operations, can in the worst case escalate confidentiality impact beyond C:L if an attacker fully recovers the SM2 private key; however, this is not reflected in the vendor scoring and would demand sustained, targeted effort against a system actively performing SM2 signatures. |
| Exploit ScenarioDerived | An attacker who can repeatedly induce and precisely time SM2 signature operations on a victim OpenSSL-based service (e.g., a TLS/PKI endpoint using Chinese GM/SM2 cryptography) collects large numbers of timing samples to infer secret scalar bits, gradually reconstructing private key material. No public exploit code is identified at time of analysis, and the high measurement precision required (AC:H) makes this a research-grade, targeted attack rather than an opportunistic one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
A timing side-channel in SM2 signature generation in OpenSSL lets a remote, unauthenticated attacker who can precisely measure how long signing operations take to infer information about the SM2 private key, producing limited confidentiality impact (CVSS 3.1 base score 3.7, vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Affected branches are 1.1.1 before 1.1.1zj, 3.0.0 before 3.0.23, 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, 3.6.0 before 3.6.5, and 4.0.0 before 4.0.3, with the fix published in the OpenSSL 4.0.3 security release. No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation activity (Exploitation: none, Automatable: no, Technical Impact: partial), and real-world exposure is sharply narrowed to deployments that actually perform SM2 signatures and are reachable over a low-jitter network path.
RemediationAI
Vendor-released patch: OpenSSL 4.0.3, which is the release tagged as the fix for this CVE; align the corresponding maintenance branches to the versions implied by the EUVD ranges (1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5) where those branches are still supported, and consume the linked upstream commits if backporting. Full details are in the OpenSSL security advisory at https://openssl-library.org/news/secadv/20260929.txt and the release notes at https://github.com/openssl/openssl/releases/tag/openssl-4.0.3. Because this is a constant-time defect in one specific signing path, a precise compensating control is available: if the service does not need SM2 (the common case outside Chinese-regulated environments), remove or disable SM2 signing from the accepted algorithm/key set so the vulnerable code path is never exercised, accepting the trade-off that SM2-based peers can no longer interoperate. Where SM2 signing must be retained and immediate upgrade is impossible, offload SM2 private-key operations to a hardware security module or cryptographic accelerator that implements SM2 signing in constant time, at the cost of hardware expenditure, added signing latency, and a new availability dependency. Network-side noise (adding jitter to signing response latency, aggressive rate-limiting or connection throttling of repeated signing requests from a single source) raises the sample-collection cost an attacker must pay, but is unreliable against a patient adversary and can degrade legitimate performance, so it should be treated only as an interim measure and paired with monitoring for high-volume, evenly spaced signing traffic. Patching remains the definitive fix; do not rely on the absence of exploit code as a reason to defer it, since the issue is a known weakness class that can be reproduced by a sufficiently motivated attacker.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-208 (Observable Timing Discrepancy): an implementation of SM2 signature generation whose execution time varies with secret-dependent values. SM2 is the Chinese national public-key algorithm (GM/T / GB commercial cryptography suite) and is used for signing in SM2-enabled TLS and certificate deployments, largely in Chinese and Chinese-interoperable environments. Signature generation involves scalar multiplication / modular arithmetic with a per-signature secret nonce and the long-term private key; when the code path is not constant-time, the elapsed time of each signature correlates with bits of those secrets, and an adversary collecting many precisely-timed measurements can statistically narrow the key space. The CVSS vector reflects this attacker model: network reachable (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H) because a targeted, resource-intensive measurement campaign over a low-jitter path is required. Note that this CVE covers the SM2 signature-generation path specifically; the same OpenSSL 4.0.3 release also fixed related constant-time issues in scalar multiplication for non-NIST EC curves (CVE-2026-54872) and in SM2 scalar multiplication on ARM64 and RISC-V (CVE-2026-54875), which are distinct findings and should not be conflated with this one. Deployments that do not use SM2 keys or SM2 signatures are not exposed to this issue.
Know when OpenSSL gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Timing side-channel is network-observable (AV:N) but needs many precise measurements (AC:H), no auth (PR:N); leaks partial key material (C:L) with no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Exploit-DB