A vulnerability (RUSTSEC-2026-0387) leading to timing attacks (side-channel attacks) has been reported in the Rust cryptographic computation crate crypto-bigint. This is not merely an issue of “just update to fix”—it directly impacts products relying on major Web3/EVM stacks such as Alloy, so we are sharing this to clarify the situation and raise awareness. 1. Vulnerability Overview Target crate: crypto-bigint (a fixed-size arithmetic library for large integers) Issue: Internal operations such as subtraction and Montgomery multiplication may introduce conditional branches due to compiler optimizations, resulting in input-dependent variations in execution time. Risk: Attackers could precisely measure execution times at millisecond or microsecond resolution to infer or reconstruct sensitive data such as private keys (timing attack). 2. Why Can’t We Immediately Upgrade? Although a patched version (v0.7.6) of crypto-bigint has been released, upstream dependency constraints are preventing adoption. The widely used EVM/Ethereum library Alloy depends on the cryptographic crate k256 v0.13. However, k256 v0.13 currently does not yet support or has not yet released an update to adopt crypto-bigint v0.7.6. As a result, simply running `cargo update` will not resolve the issue—the dependency lock retains the older version due to this upstream dependency chain. 3. Next Steps & Verification Checklist Visualize Impact: First, run `cargo tree -i crypto-bigint` or `cargo audit` to identify which dependency paths (e.g., alloy -> k256) are pulling in the vulnerable version. Monitor Upstream Updates: Keep track of pull requests or releases from k256 and Alloy to upgrade their crypto-bigint dependency. Consider Workarounds: If immediate action is required, evaluate using `[patch.crates-io]` in Cargo.toml to forcibly override dependencies and test the fix. There will likely be a delay before the fix propagates across the entire Rust/Web3 ecosystem. If you are operating any affected stack, we strongly recommend monitoring your dependency tree closely. ▼ RustSec Advisory: https://t.co/FJSYIOHwtH #Rust #RustLang #Web3 #Alloy #Ethereum #Security #Cryptography