CVE-2025-8556

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Severity Score

3.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

Se detectó una falla en la implementación de la curva elíptica FourQ de CIRCL. Esta vulnerabilidad permite a un atacante comprometer la seguridad de la sesión mediante la inyección de puntos de orden inferior y una validación incorrecta de puntos durante el intercambio de claves Diffie-Hellman.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2025-08-04 CVE Reserved
2025-08-06 CVE Published
2025-08-06 CVE Updated
2025-08-12 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-347: Improper Verification of Cryptographic Signature

CAPEC

References (5)

URL	Tag	Source
https://access.redhat.com/security/cve/CVE-2025-8556	Vdb Entry
https://bugzilla.redhat.com/show_bug.cgi?id=2371624	Issue Tracking
https://github.com/cloudflare/circl
https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm
https://github.com/cloudflare/circl/tree/v1.6.1

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Red Hat Search vendor "Red Hat"		Enterprise Linux Search vendor "Red Hat" for product "Enterprise Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Acm Search vendor "Redhat" for product "Acm"				*		-		Affected
Redhat Search vendor "Redhat"		Advanced Cluster Management For Kubernetes Search vendor "Redhat" for product "Advanced Cluster Management For Kubernetes"				*		-		Affected
Redhat Search vendor "Redhat"		Advanced Cluster Security Search vendor "Redhat" for product "Advanced Cluster Security"				*		-		Affected
Redhat Search vendor "Redhat"		Ceph Storage Search vendor "Redhat" for product "Ceph Storage"				*		-		Affected
Redhat Search vendor "Redhat"		Container Native Virtualization Search vendor "Redhat" for product "Container Native Virtualization"				*		-		Affected
Redhat Search vendor "Redhat"		Devworkspace Search vendor "Redhat" for product "Devworkspace"				*		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Ai Search vendor "Redhat" for product "Enterprise Linux Ai"				*		-		Affected
Redhat Search vendor "Redhat"		Multicluster Globalhub Search vendor "Redhat" for product "Multicluster Globalhub"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Search vendor "Redhat" for product "Openshift"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Ai Search vendor "Redhat" for product "Openshift Ai"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Builds Search vendor "Redhat" for product "Openshift Builds"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Custom Metrics Autoscaler Search vendor "Redhat" for product "Openshift Custom Metrics Autoscaler"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Gitops Search vendor "Redhat" for product "Openshift Gitops"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Pipelines Search vendor "Redhat" for product "Openshift Pipelines"				*		-		Affected
Redhat Search vendor "Redhat"		Openstack Search vendor "Redhat" for product "Openstack"				*		-		Affected
Redhat Search vendor "Redhat"		Rhdh Search vendor "Redhat" for product "Rhdh"				*		-		Affected
Redhat Search vendor "Redhat"		Serverless Search vendor "Redhat" for product "Serverless"				*		-		Affected
Redhat Search vendor "Redhat"		Service Mesh Search vendor "Redhat" for product "Service Mesh"				*		-		Affected
Redhat Search vendor "Redhat"		Trusted Application Pipeline Search vendor "Redhat" for product "Trusted Application Pipeline"				*		-		Affected
Redhat Search vendor "Redhat"		Trusted Artifact Signer Search vendor "Redhat" for product "Trusted Artifact Signer"				*		-		Affected
Redhat Search vendor "Redhat"		Trusted Profile Analyzer Search vendor "Redhat" for product "Trusted Profile Analyzer"				*		-		Affected
Redhat Search vendor "Redhat"		Windows Machine Config Search vendor "Redhat" for product "Windows Machine Config"				*		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				*		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Openshift Search vendor "Redhat" for product "Openshift"				*		-		Affected