Swift Crypto 4.5.1: Double-free when parsing RSA public key fails (CVE-2026-43823)
Swift Forums
Swift Crypto 4.5.1: Double-free when parsing RSA public key fails (CVE-2026-43823)
Note: 4.5.1 has been available since 2026-07-16; if you have already updated, no action is needed. Users of Swift Crypto should update to 4.5.1 as soon as practically possible, which addresses the following security issue: When initializing an RSA public key from DER or PEM bytes fails, the underlying EVP_PKEY is freed twice: once in the catch block and again in deinit. This can crash the process on a subsequent memory allocation. Applications that parse untrusted RSA keys with _RSA.Signing....
0 comments
No comments yet.