Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77696: OpenSSL SM2 signing can leak private key

CVE-2026-77696 · published 20 days ago

Summary

When OpenSSL creates an SM2 digital signature, the time it takes can vary depending on secret numbers used in the process. An attacker who can measure these timings across many signatures could eventually discover the private key. Update OpenSSL to a version that uses constant‑time operations or switch to a different signing method.

What to do

Update canonical openssl to version 3.0.2-0ubuntu1.30.
Update canonical openssl to version 3.0.13-0ubuntu3.16.
Update canonical openssl to version 3.5.5-1ubuntu3.6.
Update alpine openssl to version 3.3.7-r2.
Update canonical openssl to version 1.0.1f-1ubuntu2.27+esm17.
Update canonical openssl to version 1.0.2g-1ubuntu4.20+esm19.
Update canonical openssl to version 1.1.1-1ubuntu2.1~18.04.23+esm11.
Update canonical openssl1.0 to version 1.0.2n-1ubuntu5.13+esm7.
Update canonical openssl to version 1.1.1f-1ubuntu2.24+esm6.
Update debian openssl to version 3.5.7-1~deb13u3.
Update debian openssl to version 3.6.5-1.
Update openssl to version 3.3.7-r2.
Update bellsoft openssl to version 3.0.22-r1.
Update bellsoft openssl to version 3.5.9-r0.
Update openssl to version 3.0.22-r1.
Update openssl to version 3.5.9-r0.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:16.04:LTS	canonical	nodejs	All versions
Ubuntu:Pro:18.04:LTS	canonical	openssl1.0	< 1.0.2n-1ubuntu5.13+esm7 Fix: upgrade to 1.0.2n-1ubuntu5.13+esm7
–	openssl	openssl	< 4.0.3 >= 1.1.1, < 1.1.1zj >= 3.0.0, < 3.0.23 >= 3.4.0, < 3.4.8 >= 3.5.0, < 3.5.9 >= 3.6.0, < 3.6.5 >= 4.0.0, < 4.0.3
Debian:12	debian	openssl	All versions
Ubuntu:Pro:14.04:LTS	canonical	openssl	< 1.0.1f-1ubuntu2.27+esm17 Fix: upgrade to 1.0.1f-1ubuntu2.27+esm17
Ubuntu:Pro:16.04:LTS	canonical	edk2	All versions
Ubuntu:22.04:LTS	canonical	openssl	< 3.0.2-0ubuntu1.30 Fix: upgrade to 3.0.2-0ubuntu1.30
Ubuntu:Pro:FIPS-preview:22.04:LTS	canonical	openssl-fips	All versions
Ubuntu:24.04:LTS	canonical	openssl	< 3.0.13-0ubuntu3.16 Fix: upgrade to 3.0.13-0ubuntu3.16
Ubuntu:26.04:LTS	canonical	edk2-hwe	All versions
Ubuntu:26.04:LTS	canonical	openssl	< 3.5.5-1ubuntu3.6 Fix: upgrade to 3.5.5-1ubuntu3.6
Alpine:v3.21	alpine	openssl	< 3.3.7-r2 Fix: upgrade to 3.3.7-r2
Ubuntu:Pro:16.04:LTS	canonical	openssl	< 1.0.2g-1ubuntu4.20+esm19 Fix: upgrade to 1.0.2g-1ubuntu4.20+esm19
Ubuntu:Pro:18.04:LTS	canonical	openssl	< 1.1.1-1ubuntu2.1~18.04.23+esm11 Fix: upgrade to 1.1.1-1ubuntu2.1~18.04.23+esm11
Ubuntu:Pro:20.04:LTS	canonical	openssl	< 1.1.1f-1ubuntu2.24+esm6 Fix: upgrade to 1.1.1f-1ubuntu2.24+esm6
Debian:13	debian	openssl	< 3.5.7-1~deb13u3 Fix: upgrade to 3.5.7-1~deb13u3
Debian:14	debian	openssl	< 3.6.5-1 Fix: upgrade to 3.6.5-1
Alpine:v3.21	–	openssl	>= 1.1.1, < 3.3.7-r2 Fix: upgrade to 3.3.7-r2
Alpaquita:23	bellsoft	openssl	>= 3.0.8-r4, < 3.0.22-r1 Fix: upgrade to 3.0.22-r1
Alpaquita:25	bellsoft	openssl	>= 3.5.0-r0, < 3.5.9-r0 Fix: upgrade to 3.5.9-r0
Alpaquita:stream	bellsoft	openssl	>= 3.1.1-r1, < 3.5.9-r0 Fix: upgrade to 3.5.9-r0
BellSoft Hardened Containers:23	–	openssl	>= 3.0.8-r4, < 3.0.22-r1 Fix: upgrade to 3.0.22-r1
BellSoft Hardened Containers:25	–	openssl	>= 3.5.0-r0, < 3.5.9-r0 Fix: upgrade to 3.5.9-r0
BellSoft Hardened Containers:stream	–	openssl	>= 3.1.1-r1, < 3.5.9-r0 Fix: upgrade to 3.5.9-r0

Original advisory text

Timing Side-Channel in SM2 Signature Generation

Issue summary: SM2 signature generation uses non-constant-time arithmetic
on secret values, forming a timing side-channel.

Impact summary: An attacker able to measure SM2 signing times may learn
information about the per-signature secret nonce, which over many signatures
can, via a lattice / Hidden Number Problem attack, lead to recovery of the
private key.

CWE: CWE-208: Observable Timing Discrepancy

Description: SM2 signature generation computes the signature value using
variable-time BIGNUM operations on the secret nonce and the private key, so
the time taken to produce an SM2 signature depends on these secret values,
forming a timing side-channel.

Applications performing SM2 signature generation are affected on all
platforms.

FIPS Impact: no
SM2 is not a FIPS algorithm.

References

https://docs.bell-sw.com/security/cves/CVE-2026-77696 Vendor Advisory
https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164f... Patch
https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598... Patch
https://openssl-library.org/news/secadv/20260929.txt Vendor Advisory
https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e... Patch
https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f4... Patch
https://security-tracker.debian.org/tracker/CVE-2026-77696 Vendor Advisory
https://ubuntu.com/security/CVE-2026-77696 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-77696 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77696... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-77696 Vendor Advisory
https://security.alpinelinux.org/vuln/CVE-2026-77696 Vendor Advisory
https://ubuntu.com/security/notices/USN-8847-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-8847-2 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-208Observable Timing Discrepancy

Timeline

Published29 Sep 2026

Updated19 Oct 2026

First seen29 Sep 2026

Sources

CVE-2026-77696 · NVD

CVE-2026-77696 · MITRE

DEBIAN-CVE-2026-77696 · OSV

UBUNTU-CVE-2026-77696 · OSV

CVE-2026-77696 · OSV

ALPINE-CVE-2026-77696 · OSV

BELL-CVE-2026-77696 · OSV

Track software like this

Free during beta