The mirage-crypto-ec package for OCaml contains a timing side-channel vulnerability (CWE-208) in its implementation of NIST elliptic-curve scalar multiplication. Specifically, the time taken for a lookup operation can vary based on secret data, potentially allowing an attacker to infer sensitive cryptographic information through timing analysis. This issue affects versions prior to 2.4.0. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

An attacker able to measure the time taken for elliptic-curve scalar multiplication operations could potentially extract secret cryptographic keys or sensitive data due to timing discrepancies. The vulnerability impacts confidentiality but does not affect integrity or availability. The medium CVSS score reflects the network attack vector with high complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding use of vulnerable versions in high-security contexts or apply any recommended workarounds from the vendor once available.