VulnerabilityRUSTSEC-2026-0385 · ctutils
RUSTSEC-2026-0385: Non-constant-time mask generation and `u128` comparisons
Short answerA security vulnerability in the ctutils crate: Non-constant-time mask generation and `u128` comparisons. No severity score was published. Fixed in 0.4.4: update to a fixed version.
| Crate | ctutils |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Before 0.4.4. |
| Fixed in | 0.4.4 |
| Severity | not scored |
| Published | 2026-10-23 |
| Last changed | 2026-10-23 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i ctutils(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p ctutils. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplectutils = "0.4.4") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Summary
The ctutils::Choice type has mask generation functions for each unsigned integer size (u8, u16, u32, u64, u128). These are const fn and therefore can't reuse the asm!-backed mask generation in the cmov crate that's otherwise used to ensure constant-time.
In releases prior to v0.4.4, the generated code from these functions could include a branch on commonly used platforms. This has been corrected in this release and now verified on several platforms using BINSEC.
Additionally, u128 comparison operations provided via ctutils::Choice and intended to work in constant-time were generating branches on 32-bit targets. This has been resolved via a special case implementation of these functions for such targets.
Impact
Branch instructions on secret values can potentially leak such values via covert channels. This can enable attackers to potentially recover such secrets.
Resolution
This has been resolved by calling Choice::to_u8() when generating the mask, which in turn uses black_box as an optimization barrier. Verification that this resulted in the desired change in the generated assembly across a variety of target CPU architectures was performed by BINSEC, which now runs automatically in CI using cargo checkct.
References
- Package: crates.io/crates/ctutils
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0385.html
- Web: github.com/RustCrypto/utils/pull/1569
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same cratectutils: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?