Improper Check for Unusual or Exceptional Conditions Affecting openmls package, versions <0.7.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-OPENMLS-15248401
- published8 Feb 2026
- disclosed4 Feb 2026
- creditUnknown
Introduced: 4 Feb 2026
New CVE NOT AVAILABLE CWE-754 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade openmls to version 0.7.2 or higher.
Overview
Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due to improper validation of tag lengths in the authentication process. An attacker can bypass secondary authentication guarantees by crafting messages with truncated or empty tags that are still accepted as valid.
Note: This is only exploitable if the application uses public MLS messages and supports proposals by reference (standalone proposals).