{"id":"CVE-2022-50237","aliases":["EUVD-2022-55212","GHSA-w5vr-6qhr-36cc","RUSTSEC-2022-0093","UBUNTU-CVE-2022-50237","openSUSE-SU-2026:11838-1"],"status":"published","title":"`ed25519-dalek` Double Public Key Signing Function Oracle Attack","description":"The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00217,"percentile":0.12256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-497"],"published":"2022-06-11T12:00:00Z","modified":"2026-10-17T12:56:03Z","fixes":[{"ecosystem":"crates.io","package":"ed25519-dalek","fixed_in":["2.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ed25519-dalek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ed25519-dalek","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ed25519-dalek","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-curve25519-dalek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.3+20240618+dfsg-9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-curve25519-dalek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0+dfsg-1build1","4.2.0+dfsg-4","5.0.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-curve25519-dalek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.3+20240618+dfsg-9","4.2.0+dfsg-1","4.2.0+dfsg-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pijul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~beta.23-1.1"}]}],"bundled":3}],"products":[{"vendor":"dalek-cryptography","product":"ed25519-dalek"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0093.html","tags":["web","advisory","report"]},{"url":"https://github.com/MystenLabs/ed25519-unsafe-libs","tags":["web","report"]},{"url":"https://crates.io/crates/ed25519-dalek","tags":["package","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50237","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w5vr-6qhr-36cc"},{"url":"https://github.com/dalek-cryptography/ed25519-dalek","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-50237","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-50237","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-50237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-50237","description":"The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.","status":"published","published":"2025-07-28T00:00:00Z","modified":"2025-07-28T13:56:12.178Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:34:40.621895Z"}],"euvd":[{"id":"EUVD-2022-55212","description":"The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.","status":"published","published":"2025-07-28T00:00:00Z","modified":"2025-07-28T13:56:12Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:03.907132Z"}],"ghsa":[{"id":"GHSA-w5vr-6qhr-36cc","title":"`ed25519-dalek` Double Public Key Signing Function Oracle Attack","description":"Versions of `ed25519-dalek` prior to v2.0 model private and public keys as separate types which can be assembled into a `Keypair`, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.\n\nSuch APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the `S` part of the signature, but not in the `R` value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same `R` and only differ on the `S` part.\n\nUnfortunately, when this happens, one can easily extract the private key.\n\nRevised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled \"hazmat\" APIs which are clearly labeled as being dangerous if misused.","status":"published","published":"2023-08-14T21:10:29Z","modified":"2025-07-28T15:53:34Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2022-50237","description":"The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.","status":"published","published":"2025-07-28T02:15:24.54Z","modified":"2026-06-17T05:23:02.68Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:07:43.071398Z"}],"osv":[{"id":"GHSA-w5vr-6qhr-36cc","title":"`ed25519-dalek` Double Public Key Signing Function Oracle Attack","description":"Versions of `ed25519-dalek` prior to v2.0 model private and public keys as separate types which can be assembled into a `Keypair`, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.\n\nSuch APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the `S` part of the signature, but not in the `R` value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same `R` and only differ on the `S` part.\n\nUnfortunately, when this happens, one can easily extract the private key.\n\nRevised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled \"hazmat\" APIs which are clearly labeled as being dangerous if misused.","status":"published","published":"2023-08-14T21:10:29Z","modified":"2026-02-04T03:12:24.206854Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2022-50237","description":"The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.","status":"published","published":"2025-07-28T02:15:00Z","modified":"2026-10-17T12:56:03.584442551Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:14.479882Z"},{"id":"openSUSE-SU-2026:11838-1","title":"pijul-1.0.0~beta.23-1.1 on GA media","description":"These are all security issues fixed in the pijul-1.0.0~beta.23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:09.516374248Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"RUSTSEC-2022-0093","title":"Double Public Key Signing Function Oracle Attack on `ed25519-dalek`","description":"Versions of `ed25519-dalek` prior to v2.0 model private and public keys as\nseparate types which can be assembled into a `Keypair`, and also provide APIs\nfor serializing and deserializing 64-byte private/public keypairs.\n\nSuch APIs and serializations are inherently unsafe as the public key is one of\nthe inputs used in the deterministic computation of the `S` part of the signature,\nbut not in the `R` value. An adversary could somehow use the signing function as\nan oracle that allows arbitrary public keys as input can obtain two signatures\nfor the same message sharing the same `R` and only differ on the `S` part.\n\nUnfortunately, when this happens, one can easily extract the private key.\n\nRevised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled\nprivate/public keypair as signing input, except as part of specially labeled\n\"hazmat\" APIs which are clearly labeled as being dangerous if misused.","status":"published","published":"2022-06-11T12:00:00Z","modified":"2025-10-28T06:02:18Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}