CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-45696
Critical (9.8) in sha2 project sha2. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in sha2 0.9.8.
An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWE
- CWE-327
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sha2_project:sha2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fc7x-2cmc-8j2g | crates.io | sha2 | >=0.9.7 <0.9.8 | 0.9.8 |
| GHSA-xpww-g9jx-hp8r | crates.io | sha2 | >=0.9.7 <0.9.8 | 0.9.8 |
| RUSTSEC-2021-0100 | crates.io | sha2 | >=0.9.7 <0.9.8 | 0.9.8 |