AIKIDO-2026-859106
sm-crypto is vulnerable to Signature Malleability
53
CVE Score
Medium
Signature Malleability
TL;DR
The SM2 DER signature decoder in sm-crypto reads the R and S integers by their own length bytes without requiring canonical, minimal encoding. decodeDer in the ASN.1 parser does not reject non-minimal INTEGERs, check the 02 tags, or compare the outer SEQUENCE length against the actual input, and doVerifySignature only range-checks the decoded values. Prepending 00 padding bytes to the R integer and adjusting the length bytes yields distinct signature strings that all verify against the same message and public key, so signatures are malleable. The fix enforces canonical DER on the verification path.
How do I fix this?
Upgrade the sm-crypto library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application treats SM2 signature bytes as unique, for example for replay protection, deduplication, or idempotency tokens.
Package
Versions
0.0.1 - 0.5.4
Fixed in 0.5.5Background info
sm-crypto is vulnerable to Signature Malleability in versions 0.0.1 - 0.5.4.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.