{"id":"CVE-2026-77696","title":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secre…","summary":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secre…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-208"],"vendor":"openssl","product":"openssl","affected":["openssl >= 1.1.1, < 1.1.1zj","openssl >= 3.0.0, < 3.0.23","openssl >= 3.4.0, < 3.4.8","openssl >= 3.5.0, < 3.5.9","openssl >= 3.6.0, < 3.6.5","openssl >= 4.0.0, < 4.0.3"],"patched":["openssl 4.0.3"],"published":"2026-09-29","updated":"2026-10-08","sourceUpdated":"2026-10-08T01:20:41.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","references":[{"url":"https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","label":"openssl-security@openssl.org"},{"url":"https://openssl-library.org/news/secadv/20260929.txt","label":"openssl-security@openssl.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77696.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-77696"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543258"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77696"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696"},{"url":"https://access.redhat.com/errata/RHSA-2026:74162"},{"url":"https://access.redhat.com/errata/RHSA-2026:74166"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00396,"epssPercentile":0.33658,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-29T16:51:30.070097Z"},"scores":{"nvd":3.7,"vendor":5.9},"ingestedAt":"2026-09-29T16:39:33.269Z","slug":"CVE-2026-77696","body":"## Overview\n\nIssue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm.\n\n## Affected\n\n- `openssl >= 1.1.1, < 1.1.1zj`\n- `openssl >= 3.0.0, < 3.0.23`\n- `openssl >= 3.4.0, < 3.4.8`\n- `openssl >= 3.5.0, < 3.5.9`\n- `openssl >= 3.6.0, < 3.6.5`\n- `openssl >= 4.0.0, < 4.0.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssl 4.0.3`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77696.json)\n- **RHSA-2026:74162** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74162)\n- **RHSA-2026:74166** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74166)","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":212863,"id":"CVE-2026-77696","ts":1790703711306,"field":"cvss","old":null,"new":"3.7"},{"seq":212862,"id":"CVE-2026-77696","ts":1790703711306,"field":"severity","old":"none","new":"low"}]}