—

RUSTSEC-2026-0318

Sending custom to-device messages may panics

Details

Using the `IdentityBasedStrategy` setting when calling `Device::encrypt_event_raw` or `OlmMachine::encrypt_content_for_devices` may cause a panic if the recipient does not have cross-signing keys.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/matrix-sdk-crypto

Introduced in: 0.0.0-0Fixed in: 0.19.0

Upgrade matrix-sdk-crypto to 0.19.0 or newer (ecosystem crates.io).

References

https://crates.io/crates/matrix-sdk-crypto[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2026-0318.html[ADVISORY]
https://github.com/matrix-org/matrix-rust-sdk/pull/6670[WEB]
https://github.com/matrix-org/matrix-rust-sdk/commit/01b45b51299821ab03fecf46741392780f118d49[WEB]