CVE-2026-77696
Fixed in a distro release EPSS <1%CVSS 3.7
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.
Products: OpenSSL
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.21 | openssl | 3.3.7-r2 |
| Chainguard | openssl-provider-fips-3.4.0 | no fix |
| Chainguard | openssl-provider-fips-3.4.0-dbg | no fix |
| Chainguard | openssl-provider-fips-3.6.0 | no fix |
| Chainguard | openssl-provider-fips-3.6.0-dbg | no fix |
| Debian 12 | openssl | 3.0.22-1~deb12u2 |
| Debian 13 | openssl | 3.5.7-1~deb13u3 |
| Debian 14 | openssl | 3.6.5-1 |
| Red Hat hummingbird 1 | openssl | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-config-fips | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-devel | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-devel-engine | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-fips-provider-upstream | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-libs | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-perl | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3 | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-devel | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-devel-engine | 0:3.5.9-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-libs | 0:3.5.9-0.1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-3 | 3.0.8-150400.4.101.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.101.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | openssl-3 | 3.0.8-150500.5.80.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | openssl-3 | 3.0.8-150500.5.80.1 |
| SUSE Linux Enterprise Micro 5.3 | openssl-3 | 3.0.8-150400.4.101.1 |
| SUSE Linux Enterprise Micro 5.4 | openssl-3 | 3.0.8-150400.4.101.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | openssl-3 | 3.5.0-150700.5.53.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.101.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | openssl-3 | 3.0.8-150500.5.80.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | openssl-3 | 3.1.4-150600.5.67.1 |
| SUSE Linux Enterprise Server 16.0 | openssl-3 | 3.5.0-160000.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | openssl-3 | 3.0.8-150400.4.101.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | openssl-3 | 3.0.8-150500.5.80.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | openssl-3 | 3.1.4-150600.5.67.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | openssl-3 | 3.5.0-160000.11.1 |
| SUSE Linux Micro 6.0 | openssl-3 | 3.1.4-159998.1.1 |
| SUSE Linux Micro 6.2 | openssl-3 | 3.5.0-160000.11.1 |
| Ubuntu 22.04 LTS | edk2 | no fix |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.30 |
| Ubuntu 24.04 LTS | edk2 | no fix |
| Ubuntu 24.04 LTS | openssl | 3.0.13-0ubuntu3.16 |
| Ubuntu 26.04 LTS | edk2 | no fix |
| Ubuntu 26.04 LTS | edk2-hwe | no fix |
| Ubuntu 26.04 LTS | openssl | 3.5.5-1ubuntu3.6 |
| Ubuntu 26.10 | edk2 | no fix |
| Ubuntu 26.10 | edk2-hwe | no fix |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm17 |
| Ubuntu Pro 16.04 LTS | edk2 | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | openssl | 1.0.2g-1ubuntu4.20+esm19 |
| Ubuntu Pro 18.04 LTS | edk2 | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | openssl | 1.1.1-1ubuntu2.1~18.04.23+esm11 |
| Ubuntu Pro 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.13+esm7 |
| Ubuntu Pro 20.04 LTS | edk2 | no fix |
| Ubuntu Pro 20.04 LTS | openssl | 1.1.1f-1ubuntu2.24+esm6 |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssl-fips | no fix |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-updates 18.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-updates 20.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssl-fips | no fix |
| Ubuntu Pro FIPS-updates 24.04 LTS | openssl-fips | no fix |
| Ubuntu Pro FIPS 16.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS 18.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS 20.04 LTS | openssl | no fix |
| openSUSE Leap 16.0 | openssl-3 | 3.5.0-160000.11.1 |