{"id":"CVE-2026-87733","aliases":["DEBIAN-CVE-2026-87733","EUVD-2026-74619","GHSA-5v5p-5xxr-9xf8","OSEC-2026-13","UBUNTU-CVE-2026-87733"],"status":"published","title":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA...","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00151,"percentile":0.04312,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-07-27T19:00:00Z","modified":"2026-11-06T13:45:05Z","fixes":[{"ecosystem":"Debian:14","package":"ocaml-mirage-crypto","fixed_in":["2.2.0-1"],"sources":["osv"]},{"ecosystem":"opam","package":"mirage-crypto-ec","fixed_in":["2.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.11.1-1","0.11.1-2","0.11.1-3","0.11.2-1","0.11.2-2","0.11.3-1","1.1.0-1","1.1.0-2","2.0.0-1","2.0.1-1","2.0.2-1","2.0.3-1","2.1.0-1","2.2.0-1","2.2.0-2","2.3.0-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1","2.0.2-1","2.0.3-1","2.1.0-1","2.2.0-1","2.2.0-2","2.3.0-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1"}]}],"versions":["2.0.0-1","2.0.1-1","2.0.2-1","2.0.3-1","2.1.0-1"]},{"source":"osv","ecosystem":"opam","package":"mirage-crypto-ec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}],"versions":["0.9.0","0.9.1","0.9.2","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","1.0.0","1.1.0","1.2.0","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.5-4","0.10.5-4build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1-3","0.11.2-1","0.11.2-1build1","0.11.2-2build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1build5","2.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ocaml-mirage-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-1build1","2.0.2-1build1","2.0.2-1build2","2.0.2-1build3","2.0.2-1build5"]}],"products":[{"vendor":"ocaml","product":"mirage-crypto-ec"}],"references":[{"url":"https://osv.dev/vulnerability/OSEC-2026-13","tags":["exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87733"},{"url":"https://github.com/advisories/GHSA-5v5p-5xxr-9xf8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87733","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87733","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87733","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-87733","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","status":"published","published":"2026-09-09T04:08:54.652Z","modified":"2026-09-09T13:02:51.213Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-74619","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","status":"published","published":"2026-09-09T04:08:54Z","modified":"2026-09-09T13:02:51Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-5v5p-5xxr-9xf8","title":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA...","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","status":"published","published":"2026-09-09T06:31:39Z","modified":"2026-09-09T06:31:47Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:11:37.523128Z"}],"nvd":[{"id":"CVE-2026-87733","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","status":"published","published":"2026-09-09T05:18:20.43Z","modified":"2026-09-09T16:04:24.933Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"DEBIAN-CVE-2026-87733","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","status":"published","published":"2026-09-09T05:18:20.43Z","modified":"2026-10-01T03:03:52.546846403Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OSEC-2026-13","title":"ECDSA accepts the point at infinity as a P256, P384, P521 public key","description":"`P256{,P384,P521}.Dsa.pub_of_octets` accepts 0x00, the encoding of the point at infinity, as a public key. The Diffie-Hellman path rejects that point (`point_of_octets`); the ECDSA path skips the same check. Under such a key a signature can be forged with no private key, as the repro shows.\n\nThe same class is treated as high severity elsewhere. CVE-2022-21449 (\"Psychic Signatures\", OpenJDK) let a blank ECDSA signature verify, and CVE-2020-0601 (\"CurveBall\", Windows CryptoAPI) accepted a crafted ECC public key for certificate validation. Both are missing-validation forgeries on the same primitive.\n\n## Solution\n\nCheck for point at infinity in `pub_of_octets`.\n\n## Reproduction\n\n```OCaml\nmodule Dsa = Mirage_crypto_ec.P256.Dsa\n\n(* 0x00 is the SEC1 encoding of the point at infinity A a signature using it can be forged for\n   any message with no private key. *)\nlet () =\n  Mirage_crypto_rng.(set_default_generator (create ~seed:\"forge\" (module Fortuna)));\n  let o_key = Result.get_ok (Dsa.pub_of_octets \"\\x00\") in\n  let z = Digestif.SHA256.(to_raw_string (digest_string \"transfer 1000eur to mallory\")) in\n  let r, _ = Dsa.sign ~key:(Result.get_ok (Dsa.priv_of_octets z)) ~k:z z in\n  let s = String.make 31 '\\000' ^ \"\\001\" in\n  Printf.printf \"0x00 accepted as a public key:    %b\\n\" (Result.is_ok (Dsa.pub_of_octets \"\\x00\"));\n  Printf.printf \"forged (r, s=1) verifies under O:  %b\\n\" (Dsa.verify ~key:o_key (r, s) z)\n```\n\n## Timeline\n\n- June 25th 2026: report to ocaml/security-advisories\n- June 29th: acknowledgement of issue with several questions for the reporter\n- July 6th: answers from reporter, including a patch\n- July 27th: release of mirage-crypto 2.2.0 and security advisory","status":"published","published":"2026-07-27T19:00:00Z","modified":"2026-11-06T13:45:05.723432974Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T14:15:34.301796Z"},{"id":"UBUNTU-CVE-2026-87733","description":"An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.","status":"published","published":"2026-09-09T05:18:00Z","modified":"2026-10-17T13:01:14.812120951Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"}]}}