CVE-2021-38195
Overflow in libsecp256k1
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
- Record
CVE-2021-38195- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-347
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
- Record
CVE-2021-38195- Updated
- 2026-11-02
EUVDEUVD-2021-1711 No score
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
- Record
EUVD-2021-1711- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4vj-x7v9-h82m
Overflow in libsecp256k1
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
- Record
GHSA-g4vj-x7v9-h82m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-347
- Updated
- 2026-11-02
OSV
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
- Record
CVE-2021-38195- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVGHSA-g4vj-x7v9-h82m
Overflow in libsecp256k1
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
- Record
GHSA-g4vj-x7v9-h82m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-347
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0076 No score
libsecp256k1 allows overflowing signatures
libsecp256k1 accepts signatures whose R or S parameter is larger than the secp256k1 curve order, which differs from other implementations. This could lead to invalid signatures being verified.
The error is resolved in 0.5.0 by adding a check_overflow flag.
- Record
RUSTSEC-2021-0076- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsecp256k1crates.io |
before 0.5.0 | 0.5.0 |
libsecp256k1crates.io |
0.0.0-0 up to 0.5.0 | 0.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38195 is a critical vulnerability (CVSS 9.8) in Parity Libsecp256k1, published July 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in libsecp256k1 0.5.0.
References
rustsec.org/advisories/RUSTSEC-2021-0076.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/libsecp256k1/RUSTSEC-2021-0076.md
nvd.nist.gov/vuln/detail/CVE-2021-38195
github.com/paritytech/libsecp256k1/pull/67
crates.io/crates/libsecp256k1