CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
Description
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1240 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vj64-rjf3-w3v7 | CVE-2026-46654 | HIGH | - |
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss |
2026-06-11 |
| GHSA-hcp2-x6j4-29j7 | CVE-2026-22705 | MODERATE | - |
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition |
2026-04-24 |
| GHSA-434v-x5qv-pmh6 | - | HIGH | - |
libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure |
2026-03-26 |
| GHSA-7m29-f4hw-g2vx | CVE-2026-27017 | LOW |
uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots |
2026-02-27 | |
| GHSA-848j-6mx2-7j84 | CVE-2025-14505 | LOW |
Elliptic Uses a Cryptographic Primitive with a Risky Implementation |
2026-01-09 | |
| GHSA-3hg2-rh4r-8qf6 | CVE-2025-53960 | HIGH |
Apache StreamPark: Use the user’s password as the secret key Vulnerability |
2025-12-20 | |
| GHSA-r8gc-qc2c-c7vh | CVE-2025-29779 | MODERATE |
Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution` |
2025-03-19 | |
| GHSA-hj49-h7fq-px5h | CVE-2025-24802 | HIGH | - |
Soundness issue with Plonky2 look up tables |
2025-01-30 |
| GHSA-753p-wrj5-g8fj | - | HIGH | - |
PQClean has a correctness error in HQC decapsulation |
2024-12-11 |
| GHSA-7852-w36x-6mf6 | - | MODERATE | - |
Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior |
2024-05-15 |
| GHSA-6wjw-qf87-fv5v | - | LOW | - |
Laravel Encrypter Failure to decryption vulnerability |
2024-05-15 |
| GHSA-2wc6-2rcj-8v76 | CVE-2017-1000168 | MODERATE | - |
scalarmult() vulnerable to degenerate public keys |
2023-06-13 |