{"id":"CVE-2024-42460","aliases":["AZL-47430","CLSA-2026-1781139210","CLSA-2026-1781139211","CLSA-2026-1781139212","CLSA-2026-1793101918","CLSA-2026-1793102023","DEBIAN-CVE-2024-42460","EUVD-2024-2543","GHSA-977x-g7h5-7qgw","GHSA-vjh7-7g9h-fjfh","UBUNTU-CVE-2024-42460","openSUSE-SU-2025:14663-1"],"status":"published","title":"Elliptic's ECDSA missing check for whether leading bit of r and s is zero","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00459,"percentile":0.40031,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-130"],"published":"2024-08-02T00:00:00Z","modified":"2026-11-02T12:02:47Z","fixes":[{"ecosystem":"npm","package":"elliptic","fixed_in":["6.5.7"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-elliptic","fixed_in":["6.5.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-elliptic","fixed_in":["6.5.7+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"6.5.6"},{"fixed":"6.5.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-11"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.1-tuxcare.0"},{"fixed":"6.4.1-tuxcare.1"}]}],"versions":["6.4.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.4-tuxcare.0"},{"fixed":"6.5.4-tuxcare.1"}]}],"versions":["6.5.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.5-tuxcare.0"},{"fixed":"6.5.5-tuxcare.1"}]}],"versions":["6.5.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-tuxcare.0"},{"fixed":"6.5.1-tuxcare.2"}]}],"versions":["6.5.1","6.5.1-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.3-tuxcare.0"},{"fixed":"6.5.3-tuxcare.2"}]}],"versions":["6.5.3","6.5.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.4~dfsg-2","6.5.7+dfsg-1","6.6.1+dfsg+~6.4.18-1","6.6.1+dfsg+~6.4.18-2","6.6.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"elliptic","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"6.5.7"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.1~dfsg-1","6.5.1~dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.4~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.4~dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.1+dfsg+~6.4.18-1","6.6.1+dfsg+~6.4.18-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-elliptic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.1+dfsg-1","6.6.1+dfsg+~6.4.18-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git142.862ef23-1.1"}]}],"bundled":27}],"products":[{"vendor":"elliptic_project","product":"elliptic"},{"vendor":"indutny","product":"elliptic"}],"references":[{"url":"https://github.com/indutny/elliptic/pull/317","tags":["Exploit","Issue Tracking","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0005/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42460","tags":["web","advisory"]},{"url":"https://github.com/indutny/elliptic/commit/b6ff1758d9a6d1a7aec177ff6df9f586492a6315","tags":["web"]},{"url":"https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0005","tags":["web"]},{"url":"https://github.com/advisories/GHSA-977x-g7h5-7qgw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42460.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42460","tags":["advisory"]},{"url":"https://github.com/indutny/elliptic","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-42460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42460","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-42460","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2025-11-03T22:04:53.363Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-2543","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2025-11-03T22:04:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-977x-g7h5-7qgw","title":"Elliptic's ECDSA missing check for whether leading bit of r and s is zero","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T09:31:35Z","modified":"2025-11-04T16:52:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-42460","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T07:16:10.12Z","modified":"2026-06-17T07:49:29.477Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:10:15.933769Z"}],"osv":[{"id":"CVE-2024-42460","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2026-10-28T02:30:55.211711444Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-42460","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T07:16:10.12Z","modified":"2026-11-02T12:02:47.521027849Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"GHSA-977x-g7h5-7qgw","title":"Elliptic's ECDSA missing check for whether leading bit of r and s is zero","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T09:31:35Z","modified":"2025-11-04T16:52:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2024-42460","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T07:16:00Z","modified":"2026-10-17T12:56:39.037041296Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"AZL-47430","title":"CVE-2024-42460 affecting package reaper for versions less than 3.1.1-11","description":"In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.","status":"published","published":"2024-08-02T07:16:10Z","modified":"2026-04-21T04:32:54.479526Z","updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CLSA-2026-1781139210","title":"TuxCare security update for elliptic (9 CVEs)","description":"TuxCare rebuilt elliptic to address 9 CVEs. Fixed in 6.4.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:47:51.023492019Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781139211","title":"TuxCare security update for elliptic (7 CVEs)","description":"TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:47:51.046550268Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781139212","title":"TuxCare security update for elliptic (7 CVEs)","description":"TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:47:51.092078191Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1793101918","title":"TuxCare security update for elliptic (6 CVEs)","description":"TuxCare rebuilt elliptic to address 6 CVEs. Fixed in 6.5.1-tuxcare.2.","status":"published","published":"2026-10-27T11:51:58Z","modified":"2026-10-27T13:30:18.440269881Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102023","title":"TuxCare security update for elliptic (5 CVEs)","description":"TuxCare rebuilt elliptic to address 5 CVEs. Fixed in 6.5.3-tuxcare.2.","status":"published","published":"2026-10-27T11:53:43Z","modified":"2026-10-27T13:30:19.173569212Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"openSUSE-SU-2025:14663-1","title":"velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-02-04T03:47:20.18775Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}