GitHub Advisoryadvisory · Go

GHSA-q9hv-hpm4-hj6x CIRCL has an incorrect calculation in secp384r1 CombinedMult

LOW Published 2026-02-25 Modified 2026-02-25 Official page ↗
Aliases
CVE-2026-1229
Ecosystem
Go
Packages
github.com/cloudflare/circl
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber
Weaknesses
CWE-682
Reviewed
2026-02-25

Affected packages

• Go github.com/cloudflare/circl: < 1.6.3 → fixed in 1.6.3

Description

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3.

Related

Alias · CVE (1)

  • CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. vulnerability

Weakness · CWE (1)

  • CWE-682 Incorrect Calculation weakness

References