{"id":"EUVD-2026-2731","enisaUuid":"fc4a7216-5f32-31b6-8ee4-52d53e5ad69d","description":"RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.","datePublished":"Jan 15, 2026, 7:13:54 PM","dateUpdated":"Jan 15, 2026, 7:57:48 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp\nhttps://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778\n","aliases":"CVE-2026-23519\nGHSA-2gqc-6j2q-83qp\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"8a5d498e-9919-3c8c-9139-76a1bb3bd936","product":{"name":"utils","vendor":{"name":"RustCrypto"}},"product_version":"\u003c 0.4.4"}],"enisaIdVendor":[{"id":"23b17321-5580-3224-be8e-798c0ea4d4ef","vendor":{"name":"RustCrypto"}}],"enisaIdVulnerability":[{"id":"2b2c9609-245a-3bd6-899e-8cef49b12073","vulnerability":{"id":"CVE-2026-23519","description":"RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.","datePublished":"Jan 15, 2026, 7:13:54 PM","dateUpdated":"Jan 15, 2026, 7:57:48 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp\nhttps://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778\n","enisa_id":"EUVD-2026-2731\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 2, 2026, 7:19:46 AM","vulnerabilityProduct":[{"id":"98e3b970-09b6-3bd2-bb64-f2f1da93486d","product":{"name":"utils","vendor":{"name":"RustCrypto"}},"product_version":"\u003c 0.4.4"}],"vulnerabilityVendor":[{"id":"8e41000e-8020-33d0-8f85-e8863319f729","vendor":{"name":"RustCrypto"}}]}},{"id":"3d9dbd78-a1f0-3417-bbda-396e6b317c5b","vulnerability":{"id":"GHSA-2gqc-6j2q-83qp","description":"RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`","datePublished":"Jan 15, 2026, 6:17:15 PM","dateUpdated":"Jan 23, 2026, 9:46:10 PM","baseScore":0.0,"references":"https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23519\nhttps://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778\nhttps://github.com/RustCrypto/utils\nhttps://rustsec.org/advisories/RUSTSEC-2026-0003.html\n","enisa_id":"EUVD-2026-2731\n","aliases":"CVE-2026-23519\nGHSA-2gqc-6j2q-83qp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:57:39 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}