--- title: "CVE-2026-77696\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2026-77696?format=md keywords: index, follow --- # CVE-2026-77696 Publication date 29 September 2026 Last updated 30 September 2026 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/CVE-2026-77696?format=md#priority-reason ) ## Cvss 3 Severity Score **3.7 · Low** [Score breakdown](https://ubuntu.com/security/CVE-2026-77696?format=md#impact-score) Toggle side navigation ## Description Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm. [Read the notes from the security team](https://ubuntu.com/security/CVE-2026-77696?format=md#notes) ### Why is this CVE low priority? OpenSSL developers have rated this issue as being low severity [Learn more about Ubuntu priority](https://ubuntu.com/security/cves/about#priority) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | openssl | 26.04 LTS resolute | Fixed 3.5.5-1ubuntu3.6 | | 24.04 LTS noble | Fixed 3.0.13-0ubuntu3.16 | | 22.04 LTS jammy | Fixed 3.0.2-0ubuntu1.30 | | 20.04 LTS focal | Fixed 1.1.1f-1ubuntu2.24+esm6 Ubuntu Pro | | 18.04 LTS bionic | Fixed 1.1.1-1ubuntu2.1~18.04.23+esm11 Ubuntu Pro | | 16.04 LTS xenial | Fixed 1.0.2g-1ubuntu4.20+esm19 Ubuntu Pro | | 14.04 LTS trusty | Fixed 1.0.1f-1ubuntu2.27+esm17 Ubuntu Pro | | openssl-fips | 26.04 LTS resolute | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | openssl1.0 | 26.04 LTS resolute | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | 18.04 LTS bionic | Fixed 1.0.2n-1ubuntu5.13+esm7 Ubuntu Pro | | nodejs | 26.04 LTS resolute | Not affected | | 24.04 LTS noble | Not affected | | 22.04 LTS jammy | Vulnerable | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | | 14.04 LTS trusty | Not affected | | edk2 | 26.04 LTS resolute | Needs evaluation | | 24.04 LTS noble | Needs evaluation | | 22.04 LTS jammy | Needs evaluation | | 20.04 LTS focal | Needs evaluation | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | | edk2-hwe | 26.04 LTS resolute | Needs evaluation | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) edk2 in jammy embeds OpenSSL 1.1.1j edk2 in noble embeds OpenSSL 3.0.9 edk2 in resolute embeds OpenSSL 3.5.1 edk2 in stonking embeds OpenSSL 3.5.1 nodejs in jammy embeds OpenSSL 1.1.1m 4.0, 3.6, 3.5, 3.4, 3.0 and 1.1.1 are vulnerable ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 3.7 · Low * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | High | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | Low | | Integrity impact | None | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 3.7 · Low | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77696) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-77696) * [Debian](https://security-tracker.debian.org/tracker/CVE-2026-77696) ### Related Ubuntu Security Notices (USN) + [USN-8847-1](https://usn.ubuntu.com/USN-8847-1) + OpenSSL vulnerabilities + 29 September 2026 + [USN-8847-2](https://usn.ubuntu.com/USN-8847-2) + OpenSSL vulnerabilities + 29 September 2026 ### Other references * *