CVE-2026-77696

CVE-2026-77696 is a low-severity vulnerability in Openssl with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-208.

Key facts

• Severity: Low (CVSS 3.x base score 3.7)
• EPSS exploit prediction: 0% (15th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-208
• Affected product: Openssl
• Published: 2026-09-29
• Last modified: 2026-10-08

Description

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.

Frequently asked questions

What is CVE-2026-77696?

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.

How severe is CVE-2026-77696?

CVE-2026-77696 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-77696 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-77696?

CVE-2026-77696 affects Openssl. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-77696?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-77696 published?

CVE-2026-77696 was published on 2026-09-29 and last updated on 2026-10-08.

References

• https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9
• https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb
• https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64
• https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440
• https://openssl-library.org/news/secadv/20260929.txt

Affected products (1)

• cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

More vulnerabilities in Openssl

• CVE-2009-3245 — Critical (CVSS 10.0): OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c,…
• CVE-2006-3738 — Critical (CVSS 10.0): Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier…
• CVE-2026-63073 — Critical (CVSS 9.8): Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the…
• CVE-2026-31789 — Critical (CVSS 9.8): Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer…
• CVE-2022-2274 — Critical (CVSS 9.8): The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA…
• CVE-2021-3711 — Critical (CVSS 9.8): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().…

All CVEs affecting Openssl →

Other CWE-208 vulnerabilities

• CVE-2026-77987 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server.…
• CVE-2023-41313 — Critical (CVSS 9.8): The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended…
• CVE-2026-43383 — Critical (CVSS 9.4): In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be…
• CVE-2026-63132 — Critical (CVSS 9.2): OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery…
• CVE-2026-16315 — High (CVSS 8.7): OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend…
• CVE-2024-42512 — High (CVSS 8.6): Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass…

Browse all CWE-208 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

• 194.50.173.43 (ipv4-addr)
• 144.202.0.81 (ipv4-addr)
• 42.192.101.199 (ipv4-addr)
• 45.167.124.117 (ipv4-addr)
• 45.167.124.116 (ipv4-addr)
• 182.61.23.82 (ipv4-addr)
• 181.199.4.220 (ipv4-addr)
• 125.140.111.102 (ipv4-addr)