---
id: CVE-2024-52813
aliases:
  - RUSTSEC-2024-0434
  - GHSA-r5vf-wf4h-82gg
title: ' Missing facility to signal rotation of a verified cryptographic identity'
summary: ' Missing facility to signal rotation of a verified cryptographic identity'
severity: none
vendor: matrix-sdk-crypto
product: matrix-sdk-crypto
ecosystem: rust
affected:
  - 'matrix-sdk-crypto >= 0.0.0-0, < 0.8.0'
patched:
  - matrix-sdk-crypto 0.8.0
published: '2024-01-07'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:07.418421276Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2024-0434'
references:
  - url: 'https://crates.io/crates/matrix-sdk-crypto'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2024-0434.html'
  - url: 'https://github.com/matrix-org/matrix-rust-sdk/pull/3795'
tags:
  - osv
  - rust
epss: 0.00477
epssPercentile: 0.39361
ingestedAt: '2026-10-13T11:45:30.173Z'
---

## Overview

Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated
mechanism to notify that a user's cryptographic identity has changed from a
verified to an unverified one, which could cause client applications relying on
the SDK to overlook such changes.

matrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation`
enum variant which indicates that a previously verified identity has been
changed.

## Affected packages

- `matrix-sdk-crypto >= 0.0.0-0, < 0.8.0`

## Remediation

Upgrade to a patched release:

- `matrix-sdk-crypto 0.8.0`