CVE-2026-87733: Medium severity ocaml vulnerability
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pubofoctets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to signature forgery?
Deployments using mirage-crypto-ec before 2.2.0 and calling P256.Dsa.pub_of_octets, P384.Dsa.pub_of_octets, or P521.Dsa.pub_of_octets on attacker-controlled public-key encodings are exposed if they accept the 0x00 point-at-infinity encoding.
What does an attacker need to exploit this issue?
An attacker needs to provide 0x00 as an ECDSA public key to one of the affected parsing functions. Using that public key, signatures can be forged without possession of a private key.
Is a private key or user interaction required for exploitation?
No. The supplied vector indicates no privileges and no user interaction are required, and the flaw allows forgery without a private key.
How can I determine whether my application is affected?
Check whether it uses mirage-crypto-ec earlier than 2.2.0 and parses public keys with the affected P256, P384, or P521 Dsa.pub_of_octets functions. Test whether a public-key input consisting of 0x00 is accepted.