{"id":"GHSA-5chw-87w3-j9cv","revision":null,"records":[{"revision":"c670bb772150463d84667d3dff2c19af","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0334","aliases":["GHSA-5chw-87w3-j9cv"],"title":"BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses","description":"Affected versions of `bip322` accepted a BIP-322 proof created with an\nattacker-controlled private key as a valid signature for an unrelated victim\nP2WPKH or P2SH-P2WPKH address, allowing complete authentication bypass in\napplications using `verify_simple`, `verify_simple_encoded`, `verify_full`, or\n`verify_full_encoded` as proof that a user controls a Bitcoin address.\n\nIn `verify_full`, the verifier obtained the public key from the\ncaller-controlled witness and passed it to `verify_full_p2wpkh`, where the\nsupposed public-key mismatch check read the key from the same witness and\ncompared it with itself:\n\n```rust\nlet witness_pub_key = &witness.to_vec()[1];\n\nif &pub_key.to_bytes() != witness_pub_key {\n    return Err(Error::PublicKeyMismatch);\n}\n```\n\nSince `pub_key` was originally parsed from that exact witness element, this\ncomparison was tautological. The code verified that the signature was valid\nfor the public key embedded in the witness, but never verified that this\npublic key hashes to the claimed address, violating BIP-322's requirement\nthat the `message_signature` satisfy the `message_challenge` (the claimed\naddress's scriptPubKey).\n\nAs a result, an attacker could select any victim P2WPKH or P2SH-P2WPKH\naddress, construct the BIP-322 challenge for that address and message, sign\nit with their own unrelated private key, and have the proof accepted. No\nvictim key or victim interaction was required. Application-level nonces do\nnot mitigate this, since the attacker can construct and sign the current\nchallenge message with their own key.\n\nP2TR verification is not affected: the public key is derived from the\naddress's witness program rather than from the caller-controlled witness.\n\nThe flaw was corrected in commit\n[e8accbe](https://github.com/rust-bitcoin/bip322/commit/e8accbe7d39f48f030e44f333b4796e28f6aad80)\nby deriving the expected scriptPubKey from the witness public key\n(`P2WPKH(HASH160(pubkey))`, wrapped in P2SH for the nested case) and\nrequiring it to exactly equal the scriptPubKey of the claimed address before\nsignature verification, failing with `Error::PublicKeyMismatch` otherwise.\nThe fix is included in version\n[0.0.11](https://crates.io/crates/bip322/0.0.11). Affected versions 0.0.6\nthrough 0.0.10 have been yanked from crates.io.\n\nThere is no known workaround that mitigates the vulnerability. Upgrading to\nversion 0.0.11 is the recommended course of action.","state":0,"publishedAt":"2026-08-14T12:00:00+00:00","modifiedAt":"2026-10-09T08:15:18.3667828+00:00","affected":[{"ecosystem":"crates.io","name":"bip322","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.6"},{"kind":"fixed","version":"0.0.11"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/bip322","https://rustsec.org/advisories/RUSTSEC-2026-0334.html","https://github.com/rust-bitcoin/bip322/commit/e8accbe7d39f48f030e44f333b4796e28f6aad80"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0334","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0334","identifiers":["RUSTSEC-2026-0334","GHSA-5chw-87w3-j9cv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T14:21:34.5623772+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T14:21:34.5623772+00:00","lastSuccessAt":"2026-11-10T14:21:34.7231232+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.7231242+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-20f5f1620a9c4d3a163610437b9eb63d7be94e16a276e2f8f9cc654892f91ba1","complete":true,"records":421967,"lastAttemptAt":"2026-11-10T14:21:27.5892784+00:00","lastSuccessAt":"2026-11-10T14:21:27.2999239+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.5892784+00:00","snapshotPublishedAt":"2026-11-10T13:30:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-efc28183efe04e138ba7d91d47b051d0","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T14:22:00.6171939+00:00","lastSuccessAt":"2026-11-10T13:22:39.879+00:00","error":null,"lastVerifiedAt":"2026-11-10T13:22:39.879+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T14:21:34.5623772+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T14:21:34.5623772+00:00","lastSuccessAt":"2026-11-10T14:21:34.7238617+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.723862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceb2be395f4e41c0a351a924227b0d53","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T14:21:59.9529002+00:00","lastSuccessAt":"2026-11-10T14:21:59.949+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T14:21:59.949+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T14:21:27.8480987+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.8480987+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T14:21:27.6400184+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.6400184+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T14:21:34.5248017+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.5248017+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-86f40cdda9ca36627f818d0cc8237a8a8c7c22cb687d6747a4ea12bded69e17e","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T14:21:27.7432766+00:00","lastSuccessAt":"2026-11-10T11:25:00.8551311+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.7432766+00:00","snapshotPublishedAt":"2026-11-10T11:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}