🛡️ GHSA-522r-9946-fw43 — circl

🟢 CVSS 2.0 — Low ✅ No Known Exploit CWE-347 OSV

2.0

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Duplicate Advisory: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2x5j-vhc8-9cwm. This link is maintained to preserve external references.

Original Description

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity none, availability none.

Weakness class

GHSA-522r-9946-fw43 is classified as CWE-347: Improper Verification of Cryptographic Signature. A signature is not checked correctly, so forged or modified content is accepted as genuine.

Affected software

GHSA-522r-9946-fw43 is recorded against 1 package.

github.com/cloudflare/circl

Timeline and source

Published on 6 August 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
nvd.nist.gov (Advisory)
access.redhat.com (Web)
bugzilla.redhat.com (Web)
github.com (Package)
github.com (Web)

Details

Severity LOW

CVSS Score 2.0

CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE CWE-347

Public Exploit ✅ No

Source OSV

Published 2025-08-06

Updated 2026-08-12

Modified 2025-08-06

Fix URL N/A

Affected Packages

Software	From version	Fixed in
github.com/cloudflare/circl	—	—

References

WEB https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-8556

WEB https://access.redhat.com/security/cve/CVE-2025-8556

WEB https://bugzilla.redhat.com/show_bug.cgi?id=2371624

PACKAGE https://github.com/cloudflare/circl

WEB https://github.com/cloudflare/circl/tree/v1.6.1

🔗 NVD 🔗 Mitre

Similar Threats

Critical ROOT-APP-GOBINARY-CVE-2026-1229
Critical CVE-2026-1229
Unknown ECHO-6134-c525-36a8
Low CVE-2025-8556
Unknown GO-2024-2453

More GHSA 5 advisories

Browse all of GHSA 5 in the advisory index.

Free Vulnerability Check

Is your site affected by GHSA-522r-9946-fw43?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-522r-9946-fw43 and other known CVE records.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.