GHSA-346h-749j-r28w
PHPECC vulnerable to multiple cryptographic side-channel attacks
ECDSA Canonicalization
PHPECC is vulnerable to malleable ECDSA signature attacks.
Constant-Time Signer
When generating a new ECDSA signature, the GMPMath adapter was used. This class wraps the GNU Multiple Precision arithmetic library (GMP), which does not aim to provide constant-time implementations of algorithms.
An attacker capable of triggering many signatures and studying the time it takes to perform each operation would be able to leak the secret number, k, and thereby learn the private key.
EcDH Timing Leaks
When calculating a shared secret using the EcDH class, the scalar-point multiplication is based on the arithmetic defined by the Point class.
Even though the library implements a Montgomery ladder, the add(), mul(), and getDouble() methods on the Point class are not constant-time. This means that your ECDH private keys are leaking information about each bit of your private key through a timing side-channel.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
PHPECC vulnerable to multiple cryptographic side-channel attacks
ECDSA Canonicalization
PHPECC is vulnerable to malleable ECDSA signature attacks.
Constant-Time Signer
When generating a new ECDSA signature, the GMPMath adapter was used. This class wraps the GNU Multiple Precision arithmetic library (GMP), which does not aim to provide constant-time implementations of algorithms.
An attacker capable of triggering many signatures and studying the time it takes to perform each operation would be able to leak the secret number, k, and thereby learn the private key.
EcDH Timing Leaks
When calculating a shared secret using the EcDH class, the scalar-point multiplication is based on the arithmetic defined by the Point class.
Even though the library implements a Montgomery ladder, the add(), mul(), and getDouble() methods on the Point class are not constant-time. This means that your ECDH private keys are leaking information about each bit of your private key through a timing side-channel.
- Record
GHSA-346h-749j-r28w- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-203, CWE-354
- Updated
- 2026-11-02
OSV
PHPECC vulnerable to multiple cryptographic side-channel attacks
ECDSA Canonicalization
PHPECC is vulnerable to malleable ECDSA signature attacks.
Constant-Time Signer
When generating a new ECDSA signature, the GMPMath adapter was used. This class wraps the GNU Multiple Precision arithmetic library (GMP), which does not aim to provide constant-time implementations of algorithms.
An attacker capable of triggering many signatures and studying the time it takes to perform each operation would be able to leak the secret number, k, and thereby learn the private key.
EcDH Timing Leaks
When calculating a shared secret using the EcDH class, the scalar-point multiplication is based on the arithmetic defined by the Point class.
Even though the library implements a Montgomery ladder, the add(), mul(), and getDouble() methods on the Point class are not constant-time. This means that your ECDH private keys are leaking information about each bit of your private key through a timing side-channel.
- Record
GHSA-346h-749j-r28w- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-203, CWE-354
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mdanter/eccPackagist | through 1.0.0 | None known |
mdanter/eccPackagist | through 1.0.0, plus listed versions 0.2.0v0.3.0v0.3.1v0.3.2v0.4.0 Show 11 moreShow lessv0.4.1v0.4.2v0.4.3v0.4.4v0.4.5v0.4.6v0.4.7v0.5.0v0.5.1v0.5.2v1.0.0 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-346h-749j-r28w is a critical vulnerability (CVSS 9.1) in mdanter/ecc, published April 25, 2024. No source lists public exploit code. No source names a fixed version.