7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32614

CVE-2026-32614: Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability

Go ShangMi (Commercial Cryptography) Library (GMSM) is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause is that, during decryption, the elliptic-curve point C1 in the ciphertext is only deserialized and checked to be on the curve, but the implementation does not explicitly reject the point at infinity. In the current implementation, an attacker can construct C1 as the point at infinity, causing the bilinear pairing result to degenerate into the identity element in the GT group. As a result, a critical part of the key derivation input becomes a predictable constant. An attacker who only knows the target user's UID can derive the decryption key material and then forge a ciphertext that passes the integrity check. This vulnerability is fixed in 0.41.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32614

CVE-2026-32614:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/emmansun/gmsm	go	< 0.41.1	0.41.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by identifying the patched version (0.41.1) and the last vulnerable version (0.41.0) from the provided information. By comparing the commits between these two tags in the emmansun/gmsm repository, the specific security patch was located in commit 1085b2ee75a32dadb7bbec3748269d8de0f7a177. The commit message, "SM9: reject infinity points in decrypt, unwrap, verify, and key exchange," clearly indicated its purpose.

The root cause of the vulnerability is the failure to reject the elliptic curve "point at infinity" when processing external inputs like ciphertexts, signatures, or key exchange messages. The patch rectifies this by adding an IsInfinity() check after deserializing and verifying the curve point in several functions within internal/sm9/sm9.go.

The primary function associated with the described ciphertext forgery is EncryptPrivateKey.UnwrapKey. This internal function is called by the public API functions sm9.Decrypt and sm9.DecryptASN1, which are the entry points for an attacker. During exploitation, a profiler would show a call to sm9.Decrypt leading to the vulnerable EncryptPrivateKey.UnwrapKey method.

The same logical flaw was also present and fixed in other parts of the SM9 implementation, including signature verification (SignMasterPublicKey.Verify) and key exchange (KeyExchange.ConfirmResponder, respondKeyExchange), preventing similar forgery or manipulation attacks in those contexts.

Vulnerable functions

EncryptPrivateKey.UnwrapKey

internal/sm9/sm9.go

This function is responsible for decrypting ciphertexts. It deserializes an elliptic curve point C1 from the provided ciphertext. The vulnerability lies in the fact that the function only checks if the point is on the curve but fails to check if it is the point at infinity. An attacker can provide a ciphertext where C1 is the point at infinity, which causes the key derivation process to use a predictable value, allowing the attacker to forge a ciphertext that decrypts to a chosen plaintext.

SignMasterPublicKey.Verify

internal/sm9/sm9.go

This function is used for verifying SM9 signatures. It deserializes a point 'S' from the signature data. Similar to the decryption vulnerability, it did not check if 'S' was the point at infinity. This could potentially allow an attacker to forge a signature that would be accepted as valid.

KeyExchange.ConfirmResponder

internal/sm9/sm9.go

This function is part of the SM9 key exchange protocol. It processes an ephemeral public key from a peer. The function failed to reject the point at infinity, which could allow an attacker to manipulate the key exchange protocol by sending a specially crafted key.

respondKeyExchange

internal/sm9/sm9.go

This internal function is part of the SM9 key exchange protocol. It processes an ephemeral public key from the initiator. The function failed to reject the point at infinity, which could allow an attacker to manipulate the key exchange protocol by sending a specially crafted key.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.