CVE-2026-112029 diem-project CVE debrief

Who should care

Defenders who are responsible for maintaining and securing systems that use diem-project diem should assess the potential impact of this vulnerability and prioritize verification and mitigation efforts.

Why it matters

This vulnerability affects diem-project diem up to 5.1.3 and requires local access with high complexity to exploit. Defenders should prioritize verification and mitigation efforts.

• Defenders need to verify the presence of this vulnerability in their systems.
• Assess the potential impact of the vulnerability on the system.
• Implement additional security measures to prevent local attacks.

Technical summary

The vulnerability affects the SHA1 Handler component of diem-project diem up to 5.1.3. The attack requires a high level of complexity and needs to be performed locally. Manipulation of the argument salt/password leads to a password hash with insufficient computational effort. Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact. This involves checking if the diem-project diem version is within the affected range (up to 5.1.3) and understanding the local attack vector. The vulnerability has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact. This involves checking if the diem-project diem version is within the affected range (up to 5.1.3) and understanding the local attack vector.

Recommended defensive actions

• Verify the diem-project diem version and check if it is within the affected range (up to 5.1.3).
• Assess the potential impact of the vulnerability on the system.
• Consider implementing additional security measures to prevent local attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. The CVE Program record and NVD vulnerability detail provide official information about this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.