Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 29 September 2026.

Which products and versions are affected?

matrix-sdk-crypto (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.19.0; Matrix.org Matrix-Sdk-Crypto before 0.19.0.

Is there a fix for This vulnerability?

Yes. matrix-sdk-crypto (crates.io): upgrade to 0.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run matrix-sdk-crypto (crates.io) or Matrix.org Matrix-Sdk-Crypto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

matrix-sdk-crypto panic in custom to-device message encryption

Severity: info · Published 2026-09-29

The matrix-sdk-crypto library, used for end-to-end encryption in Matrix chat applications, can crash unexpectedly when sending encrypted messages to users who lack cross-signing keys. An attacker could trigger this crash by simply not having the required keys configured, causing a denial of service that disrupts messaging functionality.

Technologies: matrix-sdk-crypto (crates.io). Vendors: crates.io, Matrix.org.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 29 September 2026.
Which products and versions are affected?: matrix-sdk-crypto (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.19.0; Matrix.org Matrix-Sdk-Crypto before 0.19.0.
Is there a fix for This vulnerability?: Yes. matrix-sdk-crypto (crates.io): upgrade to 0.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run matrix-sdk-crypto (crates.io) or Matrix.org Matrix-Sdk-Crypto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-sdk-crypto (crates.io): upgrade to 0.19.0 or later
```
cargo update -p matrix-sdk-crypto
```

Technical details

A panic occurs in the encrypt_event_raw and encrypt_content_for_devices functions when IdentityBasedStrategy is used and the recipient lacks cross-signing keys. This is an unhandled error condition that crashes the application. The vulnerability affects versions prior to 0.19.0.

Affected products

matrix-org matrix-sdk-crypto before 0.19.0

Identifiers

GHSA-45pr-7vv7-f64m
RUSTSEC-2026-0318

Timeline

2026-09-29: disclosed
2026-10-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.