Ocaml Mirage-crypto-ec vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ocaml Mirage-crypto-ec: 3 record(s), with affected versions and fixes.
CVE-2026-87737
Medium · 5.9
CWE-208 Sep 9, 2026
An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is…
An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret.
CVE-2026-87736
Medium · 4.3
CWE-125 Sep 9, 2026
Out-of-bounds Read in Ocaml Mirage-crypto-ec
An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.
CVE-2026-87733
Medium · 6.2
CWE-295 Sep 9, 2026
Improper Certificate Validation in Ocaml Mirage-crypto-ec
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.