Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

cggmp24

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3crates.ioPublished

    cggmp21 has a missing check in the ZK proof used in CGGMP21

    CVE-2025-66016 · GHSA-m95p-425x-x889

    Affected
    • crates.io cggmp24 < 0.7.0-alpha.2
    Fixed in
    0.7.0-alpha.2· Vendor fix available
    Issue
    Impact cggmp21 concerns a missing check in the ZK proof that enables an attack in which a single malicious signer can reconstruct full private key. Patches cggmp21 v0.6.3 is a patch release that contains a fix that introduces this specific missing check However, cggmp21 recommends upgrading to cggmp24 v0.7.0-alpha.2 which contains many other security checks as a precaution. Follow migration guideline to upgrade. Workarounds Update to cggmp21 v0.6.3, a minor release that contains a minimal security patch. However, for full mitigation, users will need to upgrade to cggmp24 v0.7.0-alpha.2 as it contains many more security check implementations. Resources Read this blog post to learn more.

    Recommended action: Upgrade to 0.7.0-alpha.2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →