GHSA-45pr-7vv7-f64m
Sending custom to-device messages may panics
No scoreFix available
Using the IdentityBasedStrategy setting when calling
Device::encrypt_event_raw or OlmMachine::encrypt_content_for_devices may
cause a panic if the recipient does not have cross-signing keys.
What each source reports
OSVRUSTSEC-2026-0318No score
Sending custom to-device messages may panics
Using the IdentityBasedStrategy setting when calling
Device::encrypt_event_raw or OlmMachine::encrypt_content_for_devices may
cause a panic if the recipient does not have cross-signing keys.
- Record
RUSTSEC-2026-0318- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-sdk-cryptocrates.io | 0.0.0-0 up to 0.19.0 | 0.19.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-45pr-7vv7-f64m is a vulnerability with no CVSS score yet in matrix-sdk-crypto, published September 29, 2026. No source lists public exploit code. Fixed in matrix-sdk-crypto 0.19.0.