CVE-2023-50979

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1...

5.9 MediumFix available

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.59%Up 0.5 points since Dec 18, 2023

What each source reports

NVD Score used 5.9

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: CVE-2023-50979
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-203
Updated: 2026-11-02

CVE List No score

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: CVE-2023-50979
Updated: 2026-11-02

EUVDEUVD-2023-55706 No score

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: EUVD-2023-55706
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w7rq-556w-c7gg 5.9

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1...

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: GHSA-w7rq-556w-c7gg
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-203
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-50979 5.9

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: DEBIAN-CVE-2023-50979
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVJLSEC-2026-1271 5.9

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: JLSEC-2026-1271
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2023-50979 5.9

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: UBUNTU-CVE-2023-50979
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV No score

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

Record: CVE-2023-50979
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10047-1 No score

libcryptopp-devel-8.9.0-6.1 on GA media

These are all security issues fixed in the libcryptopp-devel-8.9.0-6.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10047-1
Updated: 2026-11-02

OSVSUSE-SU-2025:4310-1 No score

Security update for libcryptopp

This update for libcryptopp fixes the following issues:

CVE-2023-50979: Fixed side-channel leakage during decryption with PKCS#1v1.5 padding. (bsc#1218217)

Record: SUSE-SU-2025:4310-1
Updated: 2026-11-02

Affected products

cryptopp crypto\+\+

Affected packages

Affected packages
Package	Affected	Fixed
`libcrypto++` Debian:12	All versions, plus listed versions 8.7.0+git220824-18.8.0-18.8.0-28.9.0-18.9.0-1.18.9.0-1.1~exp18.9.0-28.9.0-3	None known
`libcrypto++` Debian:13	All versions, plus listed versions 8.9.0-28.9.0-3	None known
`libcrypto++` Debian:14	All versions, plus listed versions 8.9.0-28.9.0-3	None known
`cryptopp_jll` Julia	All versions	None known
`libcryptopp` SUSE:Linux Enterprise Module for Basesystem 15 SP6	before 8.6.0-150400.3.12.1	8.6.0-150400.3.12.1
`libcryptopp` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 8.6.0-150400.3.12.1	8.6.0-150400.3.12.1
`libcryptopp` openSUSE:Leap 15.6	before 8.6.0-150400.3.12.1	8.6.0-150400.3.12.1
`libcrypto++` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 5.6.1-65.6.1-6+deb8u1build0.14.04.15.6.1-6+deb8u3build0.14.04.15.6.1-6+deb8u3ubuntu0.1~esm1	None known
`libcrypto++` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 5.6.1-85.6.1-95.6.1-9ubuntu0.15.6.1-9ubuntu0.1+esm1	None known
`libcrypto++` Ubuntu:18.04:LTS	All versions, plus listed versions 5.6.4-8	None known

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`libcrypto++` Ubuntu:20.04:LTS	All versions, plus listed versions 5.6.4-95.6.4-9build1	None known
`libcrypto++` Ubuntu:22.04:LTS	All versions, plus listed versions 8.4.0-18.6.0-2ubuntu1	None known
`libcrypto++` Ubuntu:24.04:LTS	All versions, plus listed versions 8.8.0-18.9.0-18.9.0-1.18.9.0-1.1build1	None known
`libcrypto++` Ubuntu:25.10	All versions, plus listed versions 8.9.0-1.1build18.9.0-2	None known
`libcrypto++` Ubuntu:26.10	All versions, plus listed versions 8.9.0-2build18.9.0-3	None known
`libcrypto++` Ubuntu:26.04:LTS	All versions, plus listed versions 8.9.0-28.9.0-2build1	None known
`libcryptopp` openSUSE:Tumbleweed	before 8.9.0-6.1	8.9.0-6.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-50979 is a medium vulnerability (CVSS 5.9) in Cryptopp Crypto\+\+, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in libcryptopp 8.6.0-150400.3.12.1.

References

Show 4 moreShow less