CVE-2026-1229

Incorrect calculation in CIRCL secp384r1 CombinedMult

State: Published
Severity: 2.9 Low
Published: Feb 24, 2026
Updated: Feb 24, 2026
Reserved: Jan 20, 2026

Description

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

Scores

CVSS	Score	Vector	Source
4.0	2.9 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber	cloudflare

Weaknesses

CWE-682 Incorrect Calculation

Affected Products

Product	Versions
CIRCLCloudflare	CIRCL up to version 1.6.2 to before 1.6.3Affected

References

https://github.com/cloudflare/circl

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.