CVE-2026-43823

Name of the Vulnerable Software and Affected Versions swift-crypto versions prior to 4.5.1

Description A double-free issue occurs when initializing an RSA public key from DER or PEM bytes if an error is thrown. The EVP PKEY* is freed first in the catch block and subsequently in the deinit, which can result in a crash during future memory allocations. This behavior manifests when BoringSSL cannot decode the public key from the provided bytes.

Recommendations Update to version 4.5.1.