circl vulnerabilities

CVEs whose affected-version data names the circl package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-8556Low· 3.7

1y ago

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

▾ SunlitRed Hat · circlEPSS 0.53%via CVEORG