https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T06:34:23.720305+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5473 EUVD-2026-5473 2026-10-12T06:34:23.722196+00:00 EUVD-2026-5473 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34353 fkie_cve-2024-34353 2026-10-12T06:34:23.722224+00:00

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side `key backup` stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair. Due to a logic bug introduced in commit 71136e44c03c79f80d6d1a2446673bc4d53a2067, matrix-sdk-crypto version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate). This issue has been resolved in matrix-sdk-crypto version 0.7.1. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-9ggc-845v-gcgv GHSA-9ggc-845v-gcgv — matrix-sdk-crypto contains a log exposure of private key of the server-side key backup 2026-10-12T06:34:23.722258+00:00

Affected: crates.io: matrix-sdk-crypto

### Introduction

In Matrix, the server-side *key backup* stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair.

### Impact

Due to a logic bug introduced in https://github.com/matrix-org/matrix-rust-sdk/pull/2961/commits/71136e44c03c79f80d6d1a2446673bc4d53a2067, the matrix-sdk-crypto crate version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate).

### Patches This issue has been resolved in matrix-sdk-crypto [version 0.7.1](https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-crypto-0.7.1).

### Workarounds None.

### References

- [crates.io release](https://crates.io/crates/matrix-sdk-crypto/0.7.1)

### For more information

If you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:security@matrix.org).