Reported

September 29, 2026

Issued

October 1, 2026

Package

matrix-sdk-crypto (crates.io)

Type

Vulnerability

Aliases

• GHSA-45pr-7vv7-f64m

References

• https://github.com/matrix-org/matrix-rust-sdk/pull/6670
• https://github.com/matrix-org/matrix-rust-sdk/commit/01b45b51299821ab03fecf46741392780f118d49

Patched

• >=0.19.0

Affected Functions

Version

matrix_sdk_crypto::Device::encrypt_event_raw

• <0.19.0

matrix_sdk_crypto::OlmMachine::encrypt_content_for_devices

• <0.19.0

Description

Using the IdentityBasedStrategy setting when calling Device::encrypt_event_raw or OlmMachine::encrypt_content_for_devices may cause a panic if the recipient does not have cross-signing keys.

Advisory available under CC0-1.0 license.