GHSA-522r-9946-fw43: Duplicate Advisory: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results

August 6, 2025

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2x5j-vhc8-9cwm. This link is maintained to preserve external references.

Original Description

A flaw was found in CIRCL’s implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

References

access.redhat.com/security/cve/CVE-2025-8556
bugzilla.redhat.com/show_bug.cgi?id=2371624
github.com/advisories/GHSA-522r-9946-fw43
github.com/cloudflare/circl
github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm
github.com/cloudflare/circl/tree/v1.6.1
nvd.nist.gov/vuln/detail/CVE-2025-8556

Code Behaviors & Features

Detect and mitigate GHSA-522r-9946-fw43 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →