CVE-2026-87737: CWE-208 Observable Timing Discrepancy in OCaml mirage-crypto-ec
Affects OCaml mirage-crypto-ecSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEs
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official OCaml and mirage-crypto-ec project advisories for updates and apply any released patches promptly. Until a fix is available, consider mitigating timing side channels through application-level countermeasures if feasible.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| OCamlmirage-crypto-ec | Affected
| Fixed in
|
Description
CVE-2026-87737 is a timing side-channel vulnerability in the mirage-crypto-ec package for OCaml versions before 2.4.0. The issue arises during NIST elliptic-curve scalar multiplication where the time taken for a lookup operation can vary depending on secret data. This discrepancy can potentially allow an attacker to infer sensitive cryptographic information. The vulnerability has a medium severity rating with a CVSS score of 5.9.