CVE-2026-26958: filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity
(Point).MultiScalarMult failed to initialize its receiver.
If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.
If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.
Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on filippo.io/edwards25519 via github.com/go-sql-driver/mysql, you are not affected. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like govulncheck.
Other sources
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/filippo.io/edwards25519to a version that resolves this vulnerability.Fixed in 1.1.1 - Upgrade
Upgrade
filippo.io/edwards25519to a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26958?
CVE-2026-26958 has a moderate severity due to the potential for invalid results or undefined behavior in cryptographic operations.
How do I fix CVE-2026-26958?
To fix CVE-2026-26958, upgrade to version 1.1.1 of the filippo.io/edwards25519 package.
What causes the vulnerability in CVE-2026-26958?
The vulnerability in CVE-2026-26958 is caused by the MultiScalarMult function producing invalid results if called on a receiver that is not the identity point.
Which versions are affected by CVE-2026-26958?
CVE-2026-26958 affects filippo.io/edwards25519 versions prior to 1.1.1.
What should I do if I cannot upgrade to fix CVE-2026-26958?
If upgrading is not possible to fix CVE-2026-26958, you should avoid using the MultiScalarMult function on non-identity initialized points.