CloudflareGHSA-q9hv-hpm4-hj6x

Incorrect calculation in circl secp384r1 CombinedMult

CVE-2026-1229 · Published Feb 24, 2026

Low

Fix: upgrade to 1.6.3 or later

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.

ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in [v1.6.3](https://github.com/cloudflare/circl/releases/tag/v1.6.3).

Affected versions

Package	Affected	Fixed in
circl Product	< 1.6.3	1.6.3

Details and references

Severity from: GitHub (reviewed advisory)
Weakness: CWE-682

More Cloudflare advisories

All Cloudflare

Medium 5.6Jun 19

Use-after-free in connection ID iterator FFI functionsCVE-2026-11941fixed in 0.29.2 High 8.4Mar 5

Cache poisoning via insecure-by-default cache keyCVE-2026-2836fixed in 0.8.0 Critical 9.3Mar 5

HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding MisparsingCVE-2026-2835fixed in 0.8.0 Critical 9.3Mar 5

HTTP Request Smuggling via Premature UpgradeCVE-2026-2833fixed in 0.8.0 High 7.7Jan 21

OS Command Injection in `wrangler pages deploy`CVE-2026-0933fixed in 4.59.1 Medium 4.8Nov 4, 2025

Missing validation of redirect_uri on OAuth callback handlerGHSA-v85r-hgf6-q875fixed in upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...