matrix-sdk-crypto has 4 CVEs on record between 2024 and 2026. 1 was published in the last 90 days. The median CVSS is 4.9 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.9
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Products
- matrix-sdk-crypto 4
4
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2025-48937Medium· 4.9matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator27RUSTSEC-2026-0318NoneSending custom to-device messages may panics3CVE-2024-40648None`UserIdentity::is_verified` not checking verification status of own user identity while performing the check3CVE-2024-52813None Missing facility to signal rotation of a verified cryptographic identity3
matrix-sdk-crypto vulnerabilities
CVEs affecting matrix-sdk-crypto, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
RUSTSEC-2026-0318NoneSending custom to-device messages may panics
Sending custom to-device messages may panics
▾ Sunlitmatrix-sdk-crypto · matrix-sdk-cryptovia OSV
CVE-2025-48937Medium· 4.9matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
▾ Sunlitmatrix-sdk-crypto · matrix-sdk-cryptoEPSS 0.37%via OSV
CVE-2024-40648None`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
▾ Sunlitmatrix-sdk-crypto · matrix-sdk-cryptoEPSS 0.28%via OSV
CVE-2024-52813NoneMissing facility to signal rotation of a verified cryptographic identity
Missing facility to signal rotation of a verified cryptographic identity
▾ Sunlitmatrix-sdk-crypto · matrix-sdk-cryptoEPSS 0.49%via OSV