CVE-2026-125335

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125335", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-09T21:22:55.599Z", "datePublished": "2026-11-10T18:51:14.503Z", "dateUpdated": "2026-11-12T18:02:13.877Z"}, "containers": {"cna": {"title": "Forge: Ed25519 signature verification accepts small-order public keys", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"}, {"name": "https://github.com/digitalbazaar/forge/pull/1169", "tags": ["x_refsource_MISC"], "url": "https://github.com/digitalbazaar/forge/pull/1169"}, {"name": "https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295", "tags": ["x_refsource_MISC"], "url": "https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"}, {"name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}], "affected": [{"vendor": "digitalbazaar", "product": "forge", "versions": [{"version": "< 1.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T18:51:14.503Z"}, "descriptions": [{"lang": "en", "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3."}], "source": {"advisory": "GHSA-6889-vf6x-f3g5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:26:15.409336Z", "id": "CVE-2026-125335", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T18:02:13.877Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "forge", "vendor": "digitalbazaar", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3."}], "id": "CVE-2026-125335", "lastModified": "2026-11-12T19:16:54.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-125335", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:26:15.409336Z", "version": "2.0.3"}}]}, "published": "2026-11-10T19:21:11.250", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"}, {"source": "security-advisories@github.com", "url": "https://github.com/digitalbazaar/forge/pull/1169"}, {"source": "security-advisories@github.com", "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "node-forge: node-forge: Signature verification bypass via unvalidated small-order Ed25519 public keys", "id": "2570954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570954"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in node-forge. The library's digital signature verification does not properly reject weak or invalid public keys when validating Ed25519 signatures. A remote attacker who can provide an untrusted public key can exploit this issue to create signatures that appear valid for arbitrary messages without possessing a private key. Consequently, an attacker can bypass signature verification controls and defeat message authenticity or proof-of-possession checks."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-125335", "package_state": [{"cpe": "cpe:/a:redhat:workload_availability_nhc:0", "fix_state": "Out of support scope", "package_name": "workload-availability/node-healthcheck-must-gather-rhel9", "product_name": "Node HealthCheck Operator"}, {"cpe": "cpe:/a:redhat:workload_availability_nhc:0", "fix_state": "Out of support scope", "package_name": "workload-availability/node-healthcheck-operator-bundle", "product_name": "Node HealthCheck Operator"}, {"cpe": "cpe:/a:redhat:workload_availability_nhc:0", "fix_state": "Out of support scope", "package_name": "workload-availability/node-healthcheck-rhel9-operator", "product_name": "Node HealthCheck Operator"}, {"cpe": "cpe:/a:redhat:workload_availability_nhc:0", "fix_state": "Out of support scope", "package_name": "workload-availability/node-remediation-console-rhel8", "product_name": "Node HealthCheck Operator"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Fix deferred", "package_name": "openshift-pipelines/pipelines-hub-ui-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-1/logic-rhel9-operator", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Out of support scope", "package_name": "openshift-service-mesh/kiali-operator-bundle", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Out of support scope", "package_name": "openshift-service-mesh/kiali-rhel9-operator", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "amq-broker-bin.zip", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "amq-broker-maven-repository.zip", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "automation-eda-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "automation-gateway", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "automation-platform-ui", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "rhaf-camel-for-springboot-maven-repository.zip", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "rhaf-camel-spring-boot-maven-repository.zip", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Not affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Out of support scope", "package_name": "rhceph/rhceph-4-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Fix deferred", "package_name": "rhcl-1/rhcl-rhdh-dynamic-plugin-rhel9", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub 1"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-catalog-backend-module-keycloak", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-tech-radar-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-catalog-backend-module-gitlab", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-plugin-catalog-backend-module-gitlab-org", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-bulk-import-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-global-header", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-homepage-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/red-hat-developer-hub-backstage-plugin-quickstart", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:rhdh:2", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel10", "product_name": "Red Hat Developer Hub 2"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "redhat-fuse-maven-repository.zip", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "redhat-fuse-sources.zip", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Out of support scope", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Out of support scope", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-11-10T18:51:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-125335\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-125335\nhttps://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295\nhttps://github.com/digitalbazaar/forge/pull/1169\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.3\nhttps://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"], "statement": "This vulnerability is rated as having a Low impact because exploitation requires a target application to accept and verify Ed25519 signatures against arbitrary, untrusted public keys provided directly by an attacker. In typical Red Hat deployments, cryptographic workflows rely on internally established trust anchors, certificates, or standard key generation routines, which naturally avoid vulnerable small-order points. Furthermore, the issue cannot extract private keys or compromise signatures verified against authentic, validated keys.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "forge", "source": "cna", "vendor": "digitalbazaar"}, "product": "forge", "vendor": "digitalbazaar"}], "created": "2026-11-12T00:15:09.850536+00:00", "updated": "2026-11-12T22:00:09.548215+00:00", "vendors": ["digitalbazaar", "digitalbazaar$PRODUCT$forge"]}