Rust advisories / matrix-sdk-crypto
VulnerabilityRUSTSEC-2026-0318 · matrix-sdk-crypto
RUSTSEC-2026-0318: Sending custom to-device messages may panics
Short answerA security vulnerability in the matrix-sdk-crypto crate: Sending custom to-device messages may panics. No severity score was published. Fixed in 0.19.0: update to a fixed version.
| Crate | matrix-sdk-crypto |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.19.0. |
| Fixed in | 0.19.0 |
| Severity | not scored |
| Published | 2026-09-29 |
| Last changed | 2026-10-01 |
| Also known as | GHSA-45pr-7vv7-f64m |
| Affected functions | matrix_sdk_crypto::Device::encrypt_event_raw, matrix_sdk_crypto::OlmMachine::encrypt_content_for_devices |
What to do
- See which version you have:
cargo tree -i matrix-sdk-crypto(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-crypto. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-crypto = "0.19.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Using the IdentityBasedStrategy setting when calling Device::encrypt_event_raw or OlmMachine::encrypt_content_for_devices may cause a panic if the recipient does not have cross-signing keys.
References
- Package: crates.io/crates/matrix-sdk-crypto
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0318.html
- Web: github.com/matrix-org/matrix-rust-sdk/pull/6670
- Web: github.com/matrix-org/matrix-rust-sdk/commit/01b45b51299821ab03fecf46741392780f118d49
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for matrix-sdk-crypto
- Vulnerability HighRUSTSEC-2022-0085 · 2022-09-29matrix-sdk Impersonation of room keys
- VulnerabilityRUSTSEC-2024-0356 · 2024-07-18`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
- NoticeRUSTSEC-2024-0434 · 2024-01-07 Missing facility to signal rotation of a verified cryptographic identity
- Vulnerability MediumRUSTSEC-2025-0041 · 2025-06-11matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
- VulnerabilityRUSTSEC-2026-0159 · 2026-06-03Sender-binding gaps in to-device messages
- VulnerabilityGHSA-9ggc-845v-gcgv · 2024-05-13matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Up next
Same cratematrix-sdk-crypto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?