PT-2026-88815 · Ocaml+1 · Mirage-Crypto-Ec
CVE-2026-87736
·
Publicado
2026-08-07
·
Atualizado
2026-09-09
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
The internal Point.of octets function is missing a length check for compressed
points, and thus is raising an exception when a short buffer is provided. This
affects all NIST curves (P-256, P-384, P-521) and both
Dsa.pub of octets and
Dh.key exchange functions.Fix
The fix is to check the length of the provided buffer.
Timeline
- July 28th 2026: report to security@ocaml.org
- August 7th: release of mirage-crypto-pk 2.3.0 and security advisory
Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mirage-Crypto-Ec