{"id":"CVE-2026-1229","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-1229","generatedAt":"2026-10-28T03:25:48.367Z","title":"The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs.","description":"The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in  v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .","published":"2026-02-24T08:16:28.000Z","lastModified":"2026-06-17T10:15:22.000Z","status":"Analyzed","sourceIdentifier":"cna@cloudflare.com","cvss":{"version":"4.0","score":2.9,"severity":"LOW","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-682"],"affected":["cloudflare/circl"],"epss":{"score":0.00426,"percentile":0.36569,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/cloudflare/circl","tags":["Product"],"source":"cna@cloudflare.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1229","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}