by Kastro
Paper/Archive/CVE-2026-1229

CVE-2026-1229

Cloudflare CIRCL — Incorrect calculation in CIRCL secp384r1 CombinedMult

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.9.369 × 207.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

Affected

ProductAffectedFixed inSource
CIRCLCIRCL up to version 1.6.2 – < 1.6.31.6.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cloudflare (CNA)2.9CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/cloudflare/circl