GO-2026-4503

Invalid result or undefined behavior in filippo.io/edwards25519

At a glance

Published: 2026-02-17 21:58 UTC
Updated: 2026-02-19 20:41 UTC
CVE: CVE-2026-26958
Aliases: GHSA-fw7p-63qq-7hpr

Description

Previously, if MultiScalarMult was invoked on an initialized point who was not the identity point, MultiScalarMult produced an incorrect result. If called on an uninitialized point, MultiScalarMult exhibited undefined behavior.

Affected packages

Package	Versions
Go · filippo.io/edwards25519	introduced 0, fixed 1.1.1

References

https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hpr ADVISORY
https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database