Threats tagged 'ghsa-qmhp-mcqx-7ppw'

CVE-2026-87737 is a timing side-channel vulnerability in the mirage-crypto-ec package for OCaml versions before 2.4.0. The issue arises during NIST elliptic-curve scalar multiplication where the time taken for a lookup operation can vary depending on secret data. This discrepancy can potentially allow an attacker to infer sensitive cryptographic information. The vulnerability has a medium severity rating with a CVSS score of 5.9.