CVE-2024-42459

elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check

Published Aug 2, 2024 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00076}

epss

{'score': 0.00083}

Type Values Removed Values Added
First Time appeared Indutny
Indutny elliptic
CPEs cpe:2.3:a:indutny:elliptic:6.5.6:*:*:*:*:node.js:*:*
Vendors & Products Indutny
Indutny elliptic
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.8::el8
cpe:/a:redhat:multicluster_engine:2.3::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.9::el8
cpe:/a:redhat:multicluster_engine:2.4::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
Type Values Removed Values Added
First Time appeared Redhat acm
CPEs cpe:/a:redhat:acm:2.10::el9
Vendors & Products Redhat acm
Type Values Removed Values Added
First Time appeared Redhat multicluster Engine
CPEs cpe:/a:redhat:multicluster_engine:2.5::el8
Vendors & Products Redhat multicluster Engine
Type Values Removed Values Added
First Time appeared Redhat
Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:2.4::el8
cpe:/a:redhat:service_mesh:2.5::el8
Vendors & Products Redhat
Redhat service Mesh
Type Values Removed Values Added
Title elliptic: From NVD collector elliptic: nodejs/elliptic: EDDSA signature malleability due to missing signature length check
Weaknesses CWE-325
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Nov 3, 2025, 10:04 PM
Reserved
Aug 2, 2024, 12:00 AM
Status
Modified
Published
Aug 2, 2024, 7:16 AM
Modified
Jun 17, 2026, 7:49 AM
Severity
Moderate
Public date
Aug 2, 2024, 12:00 AM