CVE-2026-87737: mirage-crypto-ec timing side channel in NIST elliptic-curve scalar multiplication

CVE-2026-87737 · Severity: medium · CVSS 5.9 · Published 2026-09-09

mirage-crypto-ec is a cryptographic library for OCaml that implements elliptic-curve cryptography operations used in TLS, key exchange, and digital signature schemes. A timing side channel in scalar multiplication allows attackers to potentially recover secret keys through precise measurement of operation execution time, compromising the confidentiality of cryptographic material.

Technologies: OCaml Mirage-Crypto-Ec. Vendors: OCaml.

Quick answers

Is CVE-2026-87737 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87737 being exploited in the wild.
How severe is CVE-2026-87737?
Medium severity, with a CVSS score of 5.9, published 9 September 2026.
Which products and versions are affected?
OCaml Mirage-Crypto-Ec 0.11.3 through 2.3.0.
Is there a fix for CVE-2026-87737?
A patch was published on 2026-08-17: Release of mirage-crypto-ec 2.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87737 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-87737?
Check whether you run OCaml Mirage-Crypto-Ec at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A timing side channel vulnerability exists in the NIST elliptic-curve scalar multiplication implementation within mirage-crypto-ec versions 0.11.3 through 2.3.0. The vulnerability stems from secret-dependent table lookups in pre-computed tables (introduced in 0.11.3 for performance optimization): the lookup algorithm uses the secret value directly as an array index rather than performing constant-time scanning, causing variable execution time that depends on the secret. This affects Diffie-Hellman key agreement and ECDSA signature generation operations on curves P256, P384, and P521. An attacker with timing measurement capability (e.g., network timing analysis in TLS) can potentially recover secret scalars. The issue was fixed in version 2.4.0 by adopting the constant-time lookup approach used in the Go reference implementation.

Affected products

  • OCaml mirage-crypto-ec 0.11.3 through 2.3.0

Timeline

  • 2026-08-12: disclosed: Report by Eric Ebinger to security@ocaml.org
  • 2026-08-17: patched: Release of mirage-crypto-ec 2.4.0
  • 2026-08-17: advisory: Public advisory published
  • 2026-09-09: other: CVE-2026-87737 published on NVD

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.