SUSE CVE-2026-32614

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

CVE-2026-32614: Improper Verification of Cryptographic Signature

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

CVE-2026-32614

CVE-2026-32614 concerns the Go ShangMi (GMSM) library’s SM9 decryption, where the ciphertext can be forged if the point C1 is the point at infinity. The root cause is that during decryption, C1 is deserialized and checked for curve membership, but the code does not reject the point at infinity, a...

CVE-2026-32614 Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...