CVE-2026-1229 Details
Description
The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .
A vulnerability exists in the Cloudflare CIRCL cryptographic library, specifically in the ECC P384 package, related to the CombinedMult function. This function generates incorrect values for certain inputs on the secp384r1 curve. The issue arises from the use of incomplete addition formulas. However, ECDH and ECDSA signing operations that depend on this curve are not impacted. The vulnerability has been addressed in version 1.6.3.
Users can upgrade to Cloudflare CIRCL version 1.6.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cloudflare/circl | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-682 | Incorrect Calculation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cloudflare circl | < 1.6.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |