Executive brief
CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl
Affected products
- Go github.com/cloudflare/circl
Junglewise Threat Intelligence
CVE-2026-1229: GO-2026-4550 - CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl
CVE-2026-1229 · Severity: medium · CVSS 4 · Published 2026-02-27
Technologies: github.com/cloudflare/circl (Go). Vendors: Go.
Related threats
- Duplicate Advisory: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results
- GO-2025-3754 - CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl
- GO-2024-2453 - Timing side channel in github.com/cloudflare/circl
- CIRCL's Kyber: timing side-channel (kyberslash2)
- GO-2023-1765 - Leaked shared secret and weak blinding in github.com/cloudflare/circl