Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing.
Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key.
CWE: CWE-208: Observable Timing Discrepancy
Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce.
The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1.
Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue.
The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected.
FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssl | Oct 1, 2026 | Sep 29, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl-snapsafe-develUpgrade openssl-snapsafe-staticUpgrade opensslUpgrade openssl-perlUpgrade openssl11-libsUpgrade openssl11Upgrade openssl11-develUpgrade openssl-snapsafe-debuginfoUpgrade openssl-snapsafeUpgrade openssl-libsUpgrade openssl11-debuginfoUpgrade openssl-snapsafe-perlUpgrade openssl-staticUpgrade openssl-snapsafe-libsUpgrade openssl-develUpgrade openssl11-staticUpgrade openssl-debuginfo | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-perlUpgrade openssl-libsUpgrade opensslUpgrade openssl-snapsafe-libsUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade openssl-debugsourceUpgrade openssl-fips-provider-latest | Oct 13, 2026 | Sep 29, 2026 |
| Debian | — | Upgrade openssl | Oct 1, 2026 | Sep 29, 2026 |
| Freebsd | — | Upgrade FreeBSDUpgrade openssl30Upgrade openssl40Upgrade opensslUpgrade openssl34Upgrade openssl36 | Oct 5, 2026 | Sep 30, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Sep 30, 2026 | Sep 29, 2026 |
| Redhat_linux | — | No solution exists | Oct 1, 2026 | Sep 29, 2026 |
| Ubuntu | — | Upgrade openssl1.0 (Ubuntu Pro)Upgrade libssl3t64Upgrade openssl (Ubuntu Pro)Upgrade libssl3Upgrade libssl1.1 (Ubuntu Pro)Upgrade libssl1.0.0 (Ubuntu Pro) | Oct 6, 2026 | Sep 29, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub