Threats tagged 'cve-2026-87737'

CVE-2026-87737 is a timing side-channel vulnerability in the mirage-crypto-ec package for OCaml versions before 2.4.0. The issue arises during NIST elliptic-curve scalar multiplication where the time taken for a lookup operation can vary depending on secret data. This discrepancy can potentially allow an attacker to infer sensitive cryptographic information. The vulnerability has a medium severity rating with a CVSS score of 5.9.

A timing leak vulnerability exists in the scalar multiplication implementation of the mirage-crypto-ec library for NIST elliptic curves. The issue arises from secret-dependent table lookups that do not scan the entire pre-computed table, potentially leaking information through timing side channels. This flaw was introduced in version 0.11.3 and affects multiple versions up to but not including 2.4.0. The vulnerability was reported on August 12, 2026, and fixed in version 2.4.0 released on August 17, 2026.