Incorrect calculation in CIRCL secp384r1 CombinedMult (Cloudflare CIRCL)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.43 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cloudflare
- NVD status
- Analyzed
Description
The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .
Weaknesses (CWE)
- CWE-682 — Incorrect Calculation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | LOW 2.9 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber | cloudflare |
| CVSS 4.0 | LOW 2.9 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:Amber | NVD · cna@cloudflare.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-q9hv-hpm4-hj6x — CIRCL has an incorrect calculation in secp384r1 CombinedMult
- GO-2026-4550 — CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl
European references
- ENISA EUVD · EUVD-2026-7384
- GCVE · GCVE-0-2026-1229
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0736 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0339 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0315 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:cloudflare:circl:*:*:*:*:*:go:*:*< 1.6.3
Affected products
| Product | Versions |
|---|---|
| Cloudflare · CIRCL | affected CIRCL up to version 1.6.2 < 1.6.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |