The mirage-crypto-ec package versions prior to 2.4.0 for OCaml contain a timing side channel vulnerability in the implementation of NIST elliptic-curve scalar multiplication. Specifically, the time taken for a lookup operation varies based on secret data, which could be exploited to infer cryptographic secrets. This issue is tracked as CVE-2026-87737 and is classified under CWE-208 (Information Exposure Through Timing Discrepancy). The vulnerability has not been confirmed to have known exploits in the wild, and no patch information is currently available.

The vulnerability can lead to partial exposure of secret cryptographic keys through timing analysis, potentially compromising confidentiality. There is no indication of impact on integrity or availability. Exploitation requires network access with high attack complexity and no privileges or user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of affected versions in sensitive environments or apply any recommended workarounds from the vendor if available.