CVE-2026-1229

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1229", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "state": "PUBLISHED", "assignerShortName": "cloudflare", "dateReserved": "2026-01-20T13:09:57.206Z", "datePublished": "2026-02-24T07:58:54.406Z", "dateUpdated": "2026-02-24T15:10:21.738Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Go"], "product": "CIRCL", "repo": "https://github.com/cloudflare/circl", "vendor": "Cloudflare", "versions": [{"lessThan": "1.6.3", "status": "affected", "version": "CIRCL up to version 1.6.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Guido Vranken"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><div><div><div><p>The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.<br>ECDH and ECDSA signing relying on this curve are not affected.</p><p>The bug was fixed in <strong><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/cloudflare/circl/releases/tag/v1.6.3\">v1.6.3</a></strong>.</p></div></div></div></div></div><div><div><div><div><br></div></div></div></div><br>"}], "value": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 ."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 2.9, "baseSeverity": "LOW", "exploitMaturity": "PROOF_OF_CONCEPT", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-682", "description": "CWE-682 Incorrect Calculation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2026-02-24T07:58:54.406Z"}, "references": [{"url": "https://github.com/cloudflare/circl"}], "source": {"discovery": "EXTERNAL"}, "title": "Incorrect calculation in CIRCL secp384r1 CombinedMult", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T15:04:09.395394Z", "id": "CVE-2026-1229", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:10:21.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1229", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T15:04:09.395394Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:06:03.406Z"}}], "cna": {"title": "Incorrect calculation in CIRCL secp384r1 CombinedMult", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Guido Vranken"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/cloudflare/circl", "vendor": "Cloudflare", "product": "CIRCL", "versions": [{"status": "affected", "version": "CIRCL up to version 1.6.2", "lessThan": "1.6.3", "versionType": "custom"}], "platforms": ["Go"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/cloudflare/circl"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div><div><p>The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.<br>ECDH and ECDSA signing relying on this curve are not affected.</p><p>The bug was fixed in <strong><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/cloudflare/circl/releases/tag/v1.6.3\">v1.6.3</a></strong>.</p></div></div></div></div></div><div><div><div><div><br></div></div></div></div><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-682", "description": "CWE-682 Incorrect Calculation"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2026-02-24T07:58:54.406Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1229", "state": "PUBLISHED", "dateUpdated": "2026-02-24T15:10:21.738Z", "dateReserved": "2026-01-20T13:09:57.206Z", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "datePublished": "2026-02-24T07:58:54.406Z", "assignerShortName": "cloudflare"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Go"], "product": "CIRCL", "repo": "https://github.com/cloudflare/circl", "vendor": "Cloudflare", "versions": [{"lessThan": "1.6.3", "status": "affected", "version": "CIRCL up to version 1.6.2", "versionType": "custom"}]}], "source": "cna@cloudflare.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudflare:circl:*:*:*:*:*:go:*:*", "matchCriteriaId": "36CDDD6E-5A8A-4017-9B85-4C65E93B8D7F", "versionEndExcluding": "1.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 ."}, {"lang": "es", "value": "La funci\u00f3n CombinedMult en el paquete CIRCL ecc/p384 (curva secp384r1) produce un valor incorrecto para entradas espec\u00edficas. El problema se soluciona utilizando f\u00f3rmulas de adici\u00f3n completas. La firma ECDH y ECDSA que depende de esta curva no se ve afectada.\n\nEl error se corrigi\u00f3 en la v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3."}], "id": "CVE-2026-1229", "lastModified": "2026-06-17T10:15:21.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@cloudflare.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1229", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T15:04:09.395394Z", "version": "2.0.3"}}]}, "published": "2026-02-24T08:16:28.407", "references": [{"source": "cna@cloudflare.com", "tags": ["Product"], "url": "https://github.com/cloudflare/circl"}], "sourceIdentifier": "cna@cloudflare.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-682"}], "source": "cna@cloudflare.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["go"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CIRCL", "source": "cna", "vendor": "Cloudflare"}, "product": "circl", "vendor": "cloudflare"}], "analysis": {"en": {"generated_at": "2026-04-17T15:50:02.367298+00:00", "value": {"mitigation_remediation": ["Upgrade the CIRCL library to version 1.6.3 or later to apply the fixed CombinedMult implementation.", "Verify that any code paths or services in your application that originally invoked CombinedMult are functioning with the updated library and are not impacted by the bug.", "Observe application behavior after the upgrade to ensure no residual data integrity or authentication anomalies appear, and monitor for future advisories."], "summary": {"action": "Apply Update", "impact": "Incorrect calculation in the ecc/p384 CombinedMult function on the secp384r1 curve"}, "threat_synthesis": {"affected_systems": "Affected systems include any applications that incorporate Cloudflare's CIRCL cryptographic library, specifically versions of the ecc/p384 implementation prior to v1.6.3. The bug was fixed in CIRCL version 1.6.3, so all earlier versions are vulnerable.", "description_and_impact": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. While ECDH and ECDSA signing that rely on this curve are not impacted, an erroneous calculation in CombinedMult could compromise any operation that uses this routine, potentially leading to data integrity or authentication failures.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 2.9, indicating low severity, and an EPSS score of less than 1%, reflecting a very low likelihood of exploitation. It is not listed in CISA's KEV catalog. No direct attack vector is documented; exploitation would likely require an attacker to supply inputs that trigger the incorrect computation and rely on the consumer of CombinedMult to misinterpret the result. Consequently, the immediate risk to systems remains minimal but warrants patching to eliminate potential integrity issues."}}}}, "created": "2026-02-25T11:45:06.489623+00:00", "updated": "2026-04-17T16:00:11.366790+00:00", "vendors": ["cloudflare", "cloudflare$PRODUCT$circl"]}