{"id":"CVE-2026-77696","title":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secre…","summary":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secre…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-208"],"vendor":"OpenSSL","product":"OpenSSL","affected":["OpenSSL >= 4.0.0 < 4.0.3","OpenSSL >= 3.6.0 < 3.6.5","OpenSSL >= 3.5.0 < 3.5.9","OpenSSL >= 3.4.0 < 3.4.8","OpenSSL >= 3.0.0 < 3.0.23","OpenSSL >= 1.1.1 < 1.1.1zj"],"published":"2026-09-29","updated":"2026-09-29","sourceUpdated":"2026-09-29T17:17:10.343","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","references":[{"url":"https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","label":"openssl-security@openssl.org"},{"url":"https://openssl-library.org/news/secadv/20260929.txt","label":"openssl-security@openssl.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-29T16:51:30.070097Z"},"ingestedAt":"2026-09-29T16:39:33.269Z","slug":"CVE-2026-77696","body":"## Overview\n\nIssue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":212863,"id":"CVE-2026-77696","ts":1790703711306,"field":"cvss","old":null,"new":"3.7"},{"seq":212862,"id":"CVE-2026-77696","ts":1790703711306,"field":"severity","old":"none","new":"low"}]}