mirage-crypto-ec vulnerabilities
3 known CVE vulnerabilities in mirage-crypto-ec, translated and rated.
- CVE-2026-87737Medium
In the mirage-crypto-ec package before version 2.4.0 for OCaml, a timing side channel was discovered in NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret. This could allow an attacker to recover private keys through timing measurements.
- CVE-2026-87736Medium
In the mirage-crypto-ec package before version 2.3.0 for OCaml, an out-of-bounds read was discovered for compressed EC public key points. This could lead to data disclosure or program crash.
- CVE-2026-87733Medium
In the mirage-crypto-ec package before version 2.2.0 for OCaml, the ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With such a public key, signatures can be forged without a private key.