Summary
cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures
Workarounds
Users can continue using un-patched versions of library as long as they don't use presignatures in said scenarios where it weakens system security. To be sure, migrate to patched version that excludes presignatures from being used in such scenarios.
References
Read this blog post to learn more.
Impact
This attack is against presignatures used in very specific context:
- Presignatures + HD wallets derivation: security level reduces to 85 bits
Previously users could generate a presignature, and then choose a HD derivation path while issuing a partial signature viaPresignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API. - Presignatures + "raw signing" (when signer signs a hash without knowing an original message): results into signature forgery attack
Previously, users were able to configurePresignature::issue_partial_signaturewith hashed message without ever providing original mesage. In new API, this method only accepts digests for which original message has been observed.
The application uses a cryptographic algorithm known to have weaknesses, such as MD5, SHA-1, or DES. Typical impact: compromised confidentiality or integrity of protected data.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
cggmp24 v0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security. Follow migration guidelines to upgrade.
Frequently Asked Questions
- What is CVE-2025-66017? CVE-2025-66017 is a high-severity use of a broken or risky cryptographic algorithm vulnerability in cggmp21 (rust), affecting versions <= 0.6.3. It is fixed in 0.7.0-alpha.2. The application uses a cryptographic algorithm known to have weaknesses, such as MD5, SHA-1, or DES.
- Which packages are affected by CVE-2025-66017?
cggmp21(rust) (versions <= 0.6.3)cggmp24(rust) (versions < 0.7.0-alpha.2)
- Is there a fix for CVE-2025-66017? Yes. CVE-2025-66017 is fixed in 0.7.0-alpha.2. Upgrade to this version or later.
- Is CVE-2025-66017 exploitable, and should I be worried? Whether CVE-2025-66017 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2025-66017 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2025-66017? Upgrade
cggmp24to 0.7.0-alpha.2 or later.