CVE-2025-8556Low· 3.7▾ SunlitA flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Last analysed / modified upstream
0.5% → 0.5%
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
circl < 1.6.1openshift-builds/openshift-builds-controller-rhel9 (all versions)openshift-builds/openshift-builds-git-cloner-rhel9 (all versions)openshift-builds/openshift-builds-image-bundler-rhel9 (all versions)openshift-builds/openshift-builds-image-processing-rhel9 (all versions)openshift-builds/openshift-builds-waiters-rhel9 (all versions)openshift-builds/openshift-builds-webhook-rhel9 (all versions)custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 (all versions)custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 (all versions)custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle (all versions)custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 (all versions)custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator (all versions)multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (all versions)openshift-pipelines/pipelines-chains-controller-rhel8 (all versions)openshift-pipelines/pipelines-chains-controller-rhel9 (all versions)openshift-pipelines/pipelines-cli-tkn-rhel8 (all versions)openshift-pipelines/pipelines-cli-tkn-rhel9 (all versions)openshift-pipelines/pipelines-controller-rhel8 (all versions)openshift-pipelines/pipelines-controller-rhel9 (all versions)openshift-pipelines/pipelines-entrypoint-rhel8 (all versions)openshift-pipelines/pipelines-entrypoint-rhel9 (all versions)openshift-pipelines/pipelines-events-rhel8 (all versions)openshift-pipelines/pipelines-events-rhel9 (all versions)openshift-pipelines/pipelines-nop-rhel8 (all versions)openshift-pipelines/pipelines-nop-rhel9 (all versions)openshift-pipelines/pipelines-operator-bundle (all versions)openshift-pipelines/pipelines-operator-proxy-rhel8 (all versions)openshift-pipelines/pipelines-operator-proxy-rhel9 (all versions)openshift-pipelines/pipelines-operator-webhook-rhel8 (all versions)openshift-pipelines/pipelines-operator-webhook-rhel9 (all versions)openshift-pipelines/pipelines-resolvers-rhel8 (all versions)openshift-pipelines/pipelines-resolvers-rhel9 (all versions)openshift-pipelines/pipelines-rhel8-operator (all versions)openshift-pipelines/pipelines-rhel9-operator (all versions)openshift-pipelines/pipelines-sidecarlogresults-rhel8 (all versions)openshift-pipelines/pipelines-sidecarlogresults-rhel9 (all versions)openshift-pipelines/pipelines-webhook-rhel8 (all versions)openshift-pipelines/pipelines-webhook-rhel9 (all versions)openshift-pipelines/pipelines-workingdirinit-rhel8 (all versions)openshift-pipelines/pipelines-workingdirinit-rhel9 (all versions)openshift-serverless-1/kn-client-cli-artifacts-rhel8 (all versions)openshift-serverless-1/kn-client-kn-rhel8 (all versions)openshift-serverless-1/kn-plugin-event-sender-rhel8 (all versions)openshift-serverless-1/kn-plugin-func-func-util-rhel8 (all versions)openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 (all versions)openshift-service-mesh/istio-cni-rhel9 (all versions)openshift-service-mesh/istio-must-gather-rhel9 (all versions)openshift-service-mesh/istio-pilot-rhel9 (all versions)openshift-service-mesh/istio-proxyv2-rhel9 (all versions)openshift-service-mesh/istio-rhel9-operator (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Affected packages:
github.com/cloudflare/circl < 1.6.1Patched in:
github.com/cloudflare/circl 1.6.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-46598Medium· 5.3golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input (CVE-2026-46598)
CVE-2026-72360High· 8.4In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to ha…
CVE-2026-17113Medium· 6.0A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`)
CVE-2026-3219Medium· 5.0pip: pip: Incorrect file installation due to improper archive handling (CVE-2026-3219)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)