CVE-2021-45696: SHA2 Project SHA2

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.

Affected products

• SHA2 Project SHA2: version 0.9.7 only

Published 2021-12-27. Last modified 2026-06-17.