CVE-2026-23519

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-208 CWE-203

Affected software

Vendor	Product	Versions
RustCrypto	utils	< 0.4.4

References

https://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778Patch
https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qpExploit, Vendor Advisory
https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qpExploit, Vendor Advisory

Timeline

Published: Jan 15, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-23526.4The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to CVE-2026-235208.0Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service s CVE-2026-235216.5Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can cre CVE-2026-235223.7LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep CVE-2026-235238.8Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink c CVE-2026-235249.8Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes dat CVE-2026-235258.41Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in t CVE-2026-235268.8CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have th CVE-2026-235279.8H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vul CVE-2026-235286.1Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed a CVE-2026-235297.7Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an CVE-2026-235309.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validat