Rust advisories / matrix-sdk-crypto
Notice MediumRUSTSEC-2024-0434 · matrix-sdk-crypto
RUSTSEC-2024-0434: Missing facility to signal rotation of a verified cryptographic identity
Short answer Missing facility to signal rotation of a verified cryptographic identity
| Crate | matrix-sdk-crypto |
|---|---|
| Type | Notice (crypto-failure) |
| Affected versions | Before 0.8.0. |
| Fixed in | 0.8.0 |
| Severity | Medium (GitHub rating) |
| Published | 2024-01-07 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2024-52813, GHSA-r5vf-wf4h-82gg |
What to do
- See which version you have:
cargo tree -i matrix-sdk-crypto(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-crypto. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-crypto = "0.8.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.
matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
References
- Package: crates.io/crates/matrix-sdk-crypto
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0434.html
- Web: github.com/matrix-org/matrix-rust-sdk/pull/3795
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for matrix-sdk-crypto
- Vulnerability HighRUSTSEC-2022-0085 · 2022-09-29matrix-sdk Impersonation of room keys
- VulnerabilityRUSTSEC-2024-0356 · 2024-07-18`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
- Vulnerability MediumRUSTSEC-2025-0041 · 2025-06-11matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
- VulnerabilityRUSTSEC-2026-0159 · 2026-06-03Sender-binding gaps in to-device messages
- VulnerabilityRUSTSEC-2026-0318 · 2026-09-29Sending custom to-device messages may panics
- VulnerabilityGHSA-9ggc-845v-gcgv · 2024-05-13matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Up next
Same cratematrix-sdk-crypto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?