crates.io/matrix-sdk-crypto CVE-2026-45056: medium 6.9, EPSS 0.31%

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

Action: Upgrade matrix-sdk-crypto to 0.16.1 or later.

cargo update -p matrix-sdk-crypto --precise 0.16.1

Affected

Fixed versions

Sources

• osv: GHSA-wfq4-36m3-9g42
• nvd: CVE-2026-45056
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
• https://github.com/matrix-org/matrix-rust-sdk/pull/6553
• https://github.com/matrix-org/matrix-rust-sdk
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
• https://rustsec.org/advisories/RUSTSEC-2026-0159.html

CVE-2026-45056 · published 2026-06-04T14:47:05Z · modified 2026-06-04T15:00:08.092172510Z · JSON