Mirage crypto ec: Timing leak in NIST elliptic curves scalar multiplication (CVE-2026-87737)
A timing leak vulnerability exists in the scalar multiplication implementation of the mirage-crypto-ec library for NIST elliptic curves. The issue arises from secret-dependent table lookups that do not scan the entire pre-computed table, potentially leaking information through timing side channels. This flaw was introduced in version 0.11.3 and affects multiple versions up to but not including 2.4.0. The vulnerability was reported on August 12, 2026, and fixed in version 2.4.0 released on August 17, 2026.
AI Analysis
Technical Summary
The mirage-crypto-ec library's scalar multiplication uses pre-computed tables for performance. However, the lookup algorithm performs secret-dependent reads instead of scanning the entire table, causing a timing side-channel leak. Additionally, if the secret index 'n' is zero, an out-of-bounds read occurs before the patch. The fix replaces the secret-dependent index 'n - 1' with a non-secret-dependent index 'i - 1', following the approach used in the Go reference implementation. This vulnerability affects versions starting from 0.11.3 up to but excluding 2.4.0, with the patch released in version 2.4.0.
Potential Impact
The vulnerability allows an attacker to potentially recover secret scalar values used in elliptic curve operations by measuring timing differences during scalar multiplication. This compromises the confidentiality of cryptographic keys. There is no impact on integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
A patch is available in mirage-crypto-ec version 2.4.0, which replaces the secret-dependent table lookup with a constant-time approach. Users should upgrade to version 2.4.0 or later to remediate this vulnerability.
Mirage crypto ec: Timing leak in NIST elliptic curves scalar multiplication (CVE-2026-87737)
Description
A timing leak vulnerability exists in the scalar multiplication implementation of the mirage-crypto-ec library for NIST elliptic curves. The issue arises from secret-dependent table lookups that do not scan the entire pre-computed table, potentially leaking information through timing side channels. This flaw was introduced in version 0.11.3 and affects multiple versions up to but not including 2.4.0. The vulnerability was reported on August 12, 2026, and fixed in version 2.4.0 released on August 17, 2026.
CVSS v3.1
Score 5.9medium
Affected software
pkg:opam/mirage-crypto-ecRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mirage-crypto-ec library's scalar multiplication uses pre-computed tables for performance. However, the lookup algorithm performs secret-dependent reads instead of scanning the entire table, causing a timing side-channel leak. Additionally, if the secret index 'n' is zero, an out-of-bounds read occurs before the patch. The fix replaces the secret-dependent index 'n - 1' with a non-secret-dependent index 'i - 1', following the approach used in the Go reference implementation. This vulnerability affects versions starting from 0.11.3 up to but excluding 2.4.0, with the patch released in version 2.4.0.
Potential Impact
The vulnerability allows an attacker to potentially recover secret scalar values used in elliptic curve operations by measuring timing differences during scalar multiplication. This compromises the confidentiality of cryptographic keys. There is no impact on integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
A patch is available in mirage-crypto-ec version 2.4.0, which replaces the secret-dependent table lookup with a constant-time approach. Users should upgrade to version 2.4.0 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- OSEC-2026-17
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["opam"]
- Cvss Version
- 3.1
Threat ID: 6a83336dbf8831d5392a7e65
Added to database: 08/17/2026, 16:14:37 UTC
Last enriched: 09/10/2026, 14:35:57 UTC
Last updated: 10/01/2026, 09:56:05 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.