CVE-2025-8556CWE-1287

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Low · published August 6, 2025

CVSS v3.1
3.7
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2025-08-06T08:48Z
EPSS history
Timeline
  • 06 AUG 08:48Z
    Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results
    cvelistv5