CWE-1255

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63410",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:49:39.327340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:50:09.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sgbett/secp256k1-native/security/advisories/GHSA-vp2j-gqfm-r3cf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "secp256k1-native",
          "vendor": "sgbett",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.17.0, \u003c 0.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The `Montgomery ladder` uses `uint256_select` with an all-zeros or all-ones mask, but affected GCC builds at `-O2` recover the original condition and emit secret-dependent `je` or `jne` jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 `jp_add_internal` infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or `ctgrind` on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and `extconf.rb` appends `-O2`. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time `cmov`; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. `Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom.` Version 0.18.0 contains the verified fix. The advisory\u0027s broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1255",
              "description": "CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:48:09.173Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sgbett/secp256k1-native/security/advisories/GHSA-vp2j-gqfm-r3cf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sgbett/secp256k1-native/security/advisories/GHSA-vp2j-gqfm-r3cf"
        },
        {
          "name": "https://github.com/sgbett/secp256k1-native/pull/32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sgbett/secp256k1-native/pull/32"
        },
        {
          "name": "https://github.com/sgbett/secp256k1-native/commit/a89bea1617a2d063c6545ad44565dc22098c880e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sgbett/secp256k1-native/commit/a89bea1617a2d063c6545ad44565dc22098c880e"
        },
        {
          "name": "https://github.com/sgbett/secp256k1-native/blob/master/docs/advisories/0001-compiler-reconstructed-ct-branch.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sgbett/secp256k1-native/blob/master/docs/advisories/0001-compiler-reconstructed-ct-branch.md"
        },
        {
          "name": "https://github.com/sgbett/secp256k1-native/releases/tag/v0.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sgbett/secp256k1-native/releases/tag/v0.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vp2j-gqfm-r3cf",
        "discovery": "UNKNOWN"
      },
      "title": "secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63410",
    "datePublished": "2026-10-30T22:48:09.173Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-11-02T14:50:09.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3301",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:01:49.964106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:02:03.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "EFR32/EFM32 Series 2 Devices",
          "product": "Series 2 SoCs and associated modules",
          "vendor": "silabs.com",
          "versions": [
            {
              "lessThanOrEqual": "all released hardware revisions",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to use the impacted crypto curves and operations with ephemeral keys to reduce the number of DPA traces that can be collected.\u0026nbsp;"
            }
          ],
          "value": "DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to use the impacted crypto curves and operations with ephemeral keys to reduce the number of DPA traces that can be collected."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-188",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-188 Reverse Engineering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "PHYSICAL",
            "baseScore": 1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1255",
              "description": "CWE-1255 Comparison Logic is Vulnerable to Power Side-Channel Attacks",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-29T13:47:42.717Z",
        "orgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
        "shortName": "Silabs"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "permissions-required"
          ],
          "url": "https://community.silabs.com/068Vm00000O8qbY"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DPA Countermeasures Unavailable for Certain Cryptographic Operations on Series 2 Devices",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
    "assignerShortName": "Silabs",
    "cveId": "CVE-2025-3301",
    "datePublished": "2025-04-29T13:47:42.717Z",
    "dateReserved": "2025-04-04T19:53:07.856Z",
    "dateUpdated": "2025-04-29T14:02:03.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "keystone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2015-9240"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1255"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:54:41Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of `keystone` prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted.\n\n\n## Recommendation\n\nUpdate to version 0.3.16 or later.",
  "id": "GHSA-39pj-gq8q-9pfj",
  "modified": "2021-08-31T20:54:56Z",
  "published": "2018-06-07T19:43:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9240"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-39pj-gq8q-9pfj"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/60"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/keystone"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authentication Weakness in keystone"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-25714"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1255",
      "CWE-203"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-11T03:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)",
  "id": "GHSA-69gh-8q3c-phmc",
  "modified": "2024-08-01T15:31:26Z",
  "published": "2024-02-11T03:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/babelouest/rhonabwy/commit/f9fd9a1c77e48b514ebb3baf0360f87eef3d846e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-39920"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1255"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-03T04:15:04Z",
    "severity": "MODERATE"
  },
  "details": "The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the \"SnailLoad\" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.",
  "id": "GHSA-796p-jr7h-8vmq",
  "modified": "2024-08-05T21:31:19Z",
  "published": "2024-07-03T18:47:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39920"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IAIK/SnailLoad"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=40809629"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/tugraz/status/1805272833322299412"
    },
    {
      "type": "WEB",
      "url": "https://www.instagram.com/p/C8wpO1UtExw"
    },
    {
      "type": "WEB",
      "url": "https://www.rfc-editor.org/rfc/rfc9293.txt"
    },
    {
      "type": "WEB",
      "url": "https://www.snailload.com"
    },
    {
      "type": "WEB",
      "url": "https://www.snailload.com/snailload.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.tugraz.at/en/tu-graz/services/news-stories/tu-graz-news/singleview/article/neue-sicherheitsluecke-erlaubt-ueberwachung-besuchter-websites-und-angesehener-videos"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1255"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-29T14:15:32Z",
    "severity": "LOW"
  },
  "details": "DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to use the impacted crypto curves and operations with ephemeral keys to reduce the number of DPA traces that can be collected.",
  "id": "GHSA-h3wr-2jpv-p235",
  "modified": "2025-04-29T15:31:52Z",
  "published": "2025-04-29T15:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3301"
    },
    {
      "type": "WEB",
      "url": "https://community.silabs.com/068Vm00000O8qbY"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}