Shrec vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Shrec products: 1 record(s), with severity, exploitation and fixes.

UltrafastSecp256k1 1

Exploited only (KEV) →

CVE-2026-55174 Medium · 5.9 CWE-345 Sep 30, 2026

UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.