The mirage-crypto-ec library versions prior to 2.2.0 contain a cryptographic flaw in the ECDSA implementation. Specifically, the functions pub_of_octets for the P256, P384, and P521 curves accept 0x00, which encodes the point at infinity, as a valid public key. This acceptance enables signature forgery without the need for the corresponding private key, undermining the integrity guarantees of ECDSA signatures.

An attacker can forge ECDSA signatures without access to the private key, compromising the authenticity and integrity of messages or data signed using the affected library versions. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to mirage-crypto-ec version 2.2.0 or later once available or apply any official fixes provided by the vendor. Until then, avoid using affected versions for critical signature verification.