PT-2026-76731 · Git · Mirage-Crypto-Ec
Published
2026-08-07
·
Updated
2026-08-07
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
The internal Point.of octets function is missing a length check for compressed
points, and thus is raising an exception when a short buffer is provided. This
affects all NIST curves (P-256, P-384, P-521) and both
Dsa.pub of octets and
Dh.key exchange functions.Fix
The fix is to check the length of the provided buffer.
Timeline
- July 28th 2026: report to security@ocaml.org
- August 7th: release of mirage-crypto-pk 2.3.0 and security advisory
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mirage-Crypto-Ec