GO-2026-4503

vendorUSosv

Invalid result or undefined behavior in filippo.io/edwards25519

view advisory published 2026-02-17Licence: per source

Previously, if MultiScalarMult was invoked on an initialized point who was not the identity point, MultiScalarMult produced an incorrect result. If called on an uninitialized point, MultiScalarMult exhibited undefined behavior.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-26958US	—	0.41% (36th)	—	2026-02-19
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult…

references

External citations — patches, advisories, analysis.

https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abbFIX
https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hprADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan