--- id: CVE-2025-8556 title: >- Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results summary: >- A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange. severity: low cvss: 3.7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N' cvssSource: cna cwe: - CWE-1287 vendor: Red Hat product: circl affected: - circl < 1.6.1 - openshift-builds/openshift-builds-controller-rhel9 (all versions) - openshift-builds/openshift-builds-git-cloner-rhel9 (all versions) - openshift-builds/openshift-builds-image-bundler-rhel9 (all versions) - openshift-builds/openshift-builds-image-processing-rhel9 (all versions) - openshift-builds/openshift-builds-waiters-rhel9 (all versions) - openshift-builds/openshift-builds-webhook-rhel9 (all versions) - >- custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 (all versions) - >- custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 (all versions) - >- custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle (all versions) - custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 (all versions) - >- custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator (all versions) - multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (all versions) - openshift-pipelines/pipelines-chains-controller-rhel8 (all versions) - openshift-pipelines/pipelines-chains-controller-rhel9 (all versions) - openshift-pipelines/pipelines-cli-tkn-rhel8 (all versions) - openshift-pipelines/pipelines-cli-tkn-rhel9 (all versions) - openshift-pipelines/pipelines-controller-rhel8 (all versions) - openshift-pipelines/pipelines-controller-rhel9 (all versions) - openshift-pipelines/pipelines-entrypoint-rhel8 (all versions) - openshift-pipelines/pipelines-entrypoint-rhel9 (all versions) - openshift-pipelines/pipelines-events-rhel8 (all versions) - openshift-pipelines/pipelines-events-rhel9 (all versions) - openshift-pipelines/pipelines-nop-rhel8 (all versions) - openshift-pipelines/pipelines-nop-rhel9 (all versions) - openshift-pipelines/pipelines-operator-bundle (all versions) - openshift-pipelines/pipelines-operator-proxy-rhel8 (all versions) - openshift-pipelines/pipelines-operator-proxy-rhel9 (all versions) - openshift-pipelines/pipelines-operator-webhook-rhel8 (all versions) - openshift-pipelines/pipelines-operator-webhook-rhel9 (all versions) - openshift-pipelines/pipelines-resolvers-rhel8 (all versions) - openshift-pipelines/pipelines-resolvers-rhel9 (all versions) - openshift-pipelines/pipelines-rhel8-operator (all versions) - openshift-pipelines/pipelines-rhel9-operator (all versions) - openshift-pipelines/pipelines-sidecarlogresults-rhel8 (all versions) - openshift-pipelines/pipelines-sidecarlogresults-rhel9 (all versions) - openshift-pipelines/pipelines-webhook-rhel8 (all versions) - openshift-pipelines/pipelines-webhook-rhel9 (all versions) - openshift-pipelines/pipelines-workingdirinit-rhel8 (all versions) - openshift-pipelines/pipelines-workingdirinit-rhel9 (all versions) - openshift-serverless-1/kn-client-cli-artifacts-rhel8 (all versions) - openshift-serverless-1/kn-client-kn-rhel8 (all versions) - openshift-serverless-1/kn-plugin-event-sender-rhel8 (all versions) - openshift-serverless-1/kn-plugin-func-func-util-rhel8 (all versions) - openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 (all versions) - openshift-service-mesh/istio-cni-rhel9 (all versions) - openshift-service-mesh/istio-must-gather-rhel9 (all versions) - openshift-service-mesh/istio-pilot-rhel9 (all versions) - openshift-service-mesh/istio-proxyv2-rhel9 (all versions) - openshift-service-mesh/istio-rhel9-operator (all versions) ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2025-08-06T20:24:48.827225Z' published: '2025-08-06' updated: '2026-10-27' sourceUpdated: '2026-10-27T05:42:41.489Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-8556' references: - url: 'https://access.redhat.com/security/cve/CVE-2025-8556' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2371624' label: RHBZ#2371624 - url: 'https://github.com/cloudflare/circl' - url: >- https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm - url: 'https://github.com/cloudflare/circl/tree/v1.6.1' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8556' - url: 'https://news.ycombinator.com/item?id=45669593' - url: >- https://www.botanica.software/blog/cryptographic-issues-in-cloudflares-circl-fourq-implementation tags: - cve.org - osv - go epss: 0.00531 epssPercentile: 0.44701 aliases: - GHSA-2x5j-vhc8-9cwm - GO-2025-3754 ecosystem: go patched: - github.com/cloudflare/circl 1.6.1 ingestedAt: '2026-09-12T03:13:01.747Z' --- ## Overview A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange. ## Affected - `circl < 1.6.1` - `openshift-builds/openshift-builds-controller-rhel9 (all versions)` - `openshift-builds/openshift-builds-git-cloner-rhel9 (all versions)` - `openshift-builds/openshift-builds-image-bundler-rhel9 (all versions)` - `openshift-builds/openshift-builds-image-processing-rhel9 (all versions)` - `openshift-builds/openshift-builds-waiters-rhel9 (all versions)` - `openshift-builds/openshift-builds-webhook-rhel9 (all versions)` - `custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 (all versions)` - `custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 (all versions)` - `custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle (all versions)` - `custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 (all versions)` - `custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator (all versions)` - `multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (all versions)` - `openshift-pipelines/pipelines-chains-controller-rhel8 (all versions)` - `openshift-pipelines/pipelines-chains-controller-rhel9 (all versions)` - `openshift-pipelines/pipelines-cli-tkn-rhel8 (all versions)` - `openshift-pipelines/pipelines-cli-tkn-rhel9 (all versions)` - `openshift-pipelines/pipelines-controller-rhel8 (all versions)` - `openshift-pipelines/pipelines-controller-rhel9 (all versions)` - `openshift-pipelines/pipelines-entrypoint-rhel8 (all versions)` - `openshift-pipelines/pipelines-entrypoint-rhel9 (all versions)` - `openshift-pipelines/pipelines-events-rhel8 (all versions)` - `openshift-pipelines/pipelines-events-rhel9 (all versions)` - `openshift-pipelines/pipelines-nop-rhel8 (all versions)` - `openshift-pipelines/pipelines-nop-rhel9 (all versions)` - `openshift-pipelines/pipelines-operator-bundle (all versions)` - `openshift-pipelines/pipelines-operator-proxy-rhel8 (all versions)` - `openshift-pipelines/pipelines-operator-proxy-rhel9 (all versions)` - `openshift-pipelines/pipelines-operator-webhook-rhel8 (all versions)` - `openshift-pipelines/pipelines-operator-webhook-rhel9 (all versions)` - `openshift-pipelines/pipelines-resolvers-rhel8 (all versions)` - `openshift-pipelines/pipelines-resolvers-rhel9 (all versions)` - `openshift-pipelines/pipelines-rhel8-operator (all versions)` - `openshift-pipelines/pipelines-rhel9-operator (all versions)` - `openshift-pipelines/pipelines-sidecarlogresults-rhel8 (all versions)` - `openshift-pipelines/pipelines-sidecarlogresults-rhel9 (all versions)` - `openshift-pipelines/pipelines-webhook-rhel8 (all versions)` - `openshift-pipelines/pipelines-webhook-rhel9 (all versions)` - `openshift-pipelines/pipelines-workingdirinit-rhel8 (all versions)` - `openshift-pipelines/pipelines-workingdirinit-rhel9 (all versions)` - `openshift-serverless-1/kn-client-cli-artifacts-rhel8 (all versions)` - `openshift-serverless-1/kn-client-kn-rhel8 (all versions)` - `openshift-serverless-1/kn-plugin-event-sender-rhel8 (all versions)` - `openshift-serverless-1/kn-plugin-func-func-util-rhel8 (all versions)` - `openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 (all versions)` - `openshift-service-mesh/istio-cni-rhel9 (all versions)` - `openshift-service-mesh/istio-must-gather-rhel9 (all versions)` - `openshift-service-mesh/istio-pilot-rhel9 (all versions)` - `openshift-service-mesh/istio-proxyv2-rhel9 (all versions)` - `openshift-service-mesh/istio-rhel9-operator (all versions)` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ### Workarounds Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2025-8556) Affected packages: - `github.com/cloudflare/circl < 1.6.1` Patched in: - `github.com/cloudflare/circl 1.6.1` Source: https://osv.dev/vulnerability/GHSA-2x5j-vhc8-9cwm