CVE-2026-3706

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3706
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3706.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3706
Downstream
Published
2026-03-08T05:02:11.136Z
Modified
2026-08-12T16:23:54.718519Z
Severity
  • 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
mkj Dropbear S Range Check curve25519.c unpackneg signature verification
Details

A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch. The project maintainer explains: "Signature Malleability is not exploitable in SSH protocol. (...) [A] PoC doesn't exist for SSH implementation, but rather it's against the internal API."

Database specific 
{
    "isDisputed": true,
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3706.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2025.0"
                },
                {
                    "last_affected": "2025.0"
                },
                {
                    "introduced": "2025.1"
                },
                {
                    "last_affected": "2025.1"
                },
                {
                    "introduced": "2025.2"
                },
                {
                    "last_affected": "2025.2"
                },
                {
                    "introduced": "2025.3"
                },
                {
                    "last_affected": "2025.3"
                },
                {
                    "introduced": "2025.4"
                },
                {
                    "last_affected": "2025.4"
                },
                {
                    "introduced": "2025.5"
                },
                {
                    "last_affected": "2025.5"
                },
                {
                    "introduced": "2025.6"
                },
                {
                    "last_affected": "2025.6"
                },
                {
                    "introduced": "2025.7"
                },
                {
                    "last_affected": "2025.7"
                },
                {
                    "introduced": "2025.8"
                },
                {
                    "last_affected": "2025.8"
                },
                {
                    "introduced": "2025.9"
                },
                {
                    "last_affected": "2025.9"
                },
                {
                    "introduced": "2025.10"
                },
                {
                    "last_affected": "2025.10"
                },
                {
                    "introduced": "2025.11"
                },
                {
                    "last_affected": "2025.11"
                },
                {
                    "introduced": "2025.12"
                },
                {
                    "last_affected": "2025.12"
                },
                {
                    "introduced": "2025.13"
                },
                {
                    "last_affected": "2025.13"
                },
                {
                    "introduced": "2025.14"
                },
                {
                    "last_affected": "2025.14"
                },
                {
                    "introduced": "2025.15"
                },
                {
                    "last_affected": "2025.15"
                },
                {
                    "introduced": "2025.16"
                },
                {
                    "last_affected": "2025.16"
                },
                {
                    "introduced": "2025.17"
                },
                {
                    "last_affected": "2025.17"
                },
                {
                    "introduced": "2025.18"
                },
                {
                    "last_affected": "2025.18"
                },
                {
                    "introduced": "2025.19"
                },
                {
                    "last_affected": "2025.19"
                },
                {
                    "introduced": "2025.20"
                },
                {
                    "last_affected": "2025.20"
                },
                {
                    "introduced": "2025.21"
                },
                {
                    "last_affected": "2025.21"
                },
                {
                    "introduced": "2025.22"
                },
                {
                    "last_affected": "2025.22"
                },
                {
                    "introduced": "2025.23"
                },
                {
                    "last_affected": "2025.23"
                },
                {
                    "introduced": "2025.24"
                },
                {
                    "last_affected": "2025.24"
                },
                {
                    "introduced": "2025.25"
                },
                {
                    "last_affected": "2025.25"
                },
                {
                    "introduced": "2025.26"
                },
                {
                    "last_affected": "2025.26"
                },
                {
                    "introduced": "2025.27"
                },
                {
                    "last_affected": "2025.27"
                },
                {
                    "introduced": "2025.28"
                },
                {
                    "last_affected": "2025.28"
                },
                {
                    "introduced": "2025.29"
                },
                {
                    "last_affected": "2025.29"
                },
                {
                    "introduced": "2025.30"
                },
                {
                    "last_affected": "2025.30"
                },
                {
                    "introduced": "2025.31"
                },
                {
                    "last_affected": "2025.31"
                },
                {
                    "introduced": "2025.32"
                },
                {
                    "last_affected": "2025.32"
                },
                {
                    "introduced": "2025.33"
                },
                {
                    "last_affected": "2025.33"
                },
                {
                    "introduced": "2025.34"
                },
                {
                    "last_affected": "2025.34"
                },
                {
                    "introduced": "2025.35"
                },
                {
                    "last_affected": "2025.35"
                },
                {
                    "introduced": "2025.36"
                },
                {
                    "last_affected": "2025.36"
                },
                {
                    "introduced": "2025.37"
                },
                {
                    "last_affected": "2025.37"
                },
                {
                    "introduced": "2025.38"
                },
                {
                    "last_affected": "2025.38"
                },
                {
                    "introduced": "2025.39"
                },
                {
                    "last_affected": "2025.39"
                },
                {
                    "introduced": "2025.40"
                },
                {
                    "last_affected": "2025.40"
                },
                {
                    "introduced": "2025.41"
                },
                {
                    "last_affected": "2025.41"
                },
                {
                    "introduced": "2025.42"
                },
                {
                    "last_affected": "2025.42"
                },
                {
                    "introduced": "2025.43"
                },
                {
                    "last_affected": "2025.43"
                },
                {
                    "introduced": "2025.44"
                },
                {
                    "last_affected": "2025.44"
                },
                {
                    "introduced": "2025.45"
                },
                {
                    "last_affected": "2025.45"
                },
                {
                    "introduced": "2025.46"
                },
                {
                    "last_affected": "2025.46"
                },
                {
                    "introduced": "2025.47"
                },
                {
                    "last_affected": "2025.47"
                },
                {
                    "introduced": "2025.48"
                },
                {
                    "last_affected": "2025.48"
                },
                {
                    "introduced": "2025.49"
                },
                {
                    "last_affected": "2025.49"
                },
                {
                    "introduced": "2025.50"
                },
                {
                    "last_affected": "2025.50"
                },
                {
                    "introduced": "2025.51"
                },
                {
                    "last_affected": "2025.51"
                },
                {
                    "introduced": "2025.52"
                },
                {
                    "last_affected": "2025.52"
                },
                {
                    "introduced": "2025.53"
                },
                {
                    "last_affected": "2025.53"
                },
                {
                    "introduced": "2025.54"
                },
                {
                    "last_affected": "2025.54"
                },
                {
                    "introduced": "2025.55"
                },
                {
                    "last_affected": "2025.55"
                },
                {
                    "introduced": "2025.56"
                },
                {
                    "last_affected": "2025.56"
                },
                {
                    "introduced": "2025.57"
                },
                {
                    "last_affected": "2025.57"
                },
                {
                    "introduced": "2025.58"
                },
                {
                    "last_affected": "2025.58"
                },
                {
                    "introduced": "2025.59"
                },
                {
                    "last_affected": "2025.59"
                },
                {
                    "introduced": "2025.60"
                },
                {
                    "last_affected": "2025.60"
                },
                {
                    "introduced": "2025.61"
                },
                {
                    "last_affected": "2025.61"
                },
                {
                    "introduced": "2025.62"
                },
                {
                    "last_affected": "2025.62"
                },
                {
                    "introduced": "2025.63"
                },
                {
                    "last_affected": "2025.63"
                },
                {
                    "introduced": "2025.64"
                },
                {
                    "last_affected": "2025.64"
                },
                {
                    "introduced": "2025.65"
                },
                {
                    "last_affected": "2025.65"
                },
                {
                    "introduced": "2025.66"
                },
                {
                    "last_affected": "2025.66"
                },
                {
                    "introduced": "2025.67"
                },
                {
                    "last_affected": "2025.67"
                },
                {
                    "introduced": "2025.68"
                },
                {
                    "last_affected": "2025.68"
                },
                {
                    "introduced": "2025.69"
                },
                {
                    "last_affected": "2025.69"
                },
                {
                    "introduced": "2025.70"
                },
                {
                    "last_affected": "2025.70"
                },
                {
                    "introduced": "2025.71"
                },
                {
                    "last_affected": "2025.71"
                },
                {
                    "introduced": "2025.72"
                },
                {
                    "last_affected": "2025.72"
                },
                {
                    "introduced": "2025.73"
                },
                {
                    "last_affected": "2025.73"
                },
                {
                    "introduced": "2025.74"
                },
                {
                    "last_affected": "2025.74"
                },
                {
                    "introduced": "2025.75"
                },
                {
                    "last_affected": "2025.75"
                },
                {
                    "introduced": "2025.76"
                },
                {
                    "last_affected": "2025.76"
                },
                {
                    "introduced": "2025.77"
                },
                {
                    "last_affected": "2025.77"
                },
                {
                    "introduced": "2025.78"
                },
                {
                    "last_affected": "2025.78"
                },
                {
                    "introduced": "2025.79"
                },
                {
                    "last_affected": "2025.79"
                },
                {
                    "introduced": "2025.80"
                },
                {
                    "last_affected": "2025.80"
                },
                {
                    "introduced": "2025.81"
                },
                {
                    "last_affected": "2025.81"
                },
                {
                    "introduced": "2025.82"
                },
                {
                    "last_affected": "2025.82"
                },
                {
                    "introduced": "2025.83"
                },
                {
                    "last_affected": "2025.83"
                },
                {
                    "introduced": "2025.84"
                },
                {
                    "last_affected": "2025.84"
                },
                {
                    "introduced": "2025.85"
                },
                {
                    "last_affected": "2025.85"
                },
                {
                    "introduced": "2025.86"
                },
                {
                    "last_affected": "2025.86"
                }
            ]
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-345",
        "CWE-347"
    ]
}
References

Affected packages

Git / github.com/mkj/dropbear

Affected ranges

Type
GIT
Repo
https://github.com/mkj/dropbear
Events
Introduced
e2f854c2b5d4f3169b97746fa1a6cfa93f50413e
Fixed
fdec3c90a15447bd538641d85e5a3e3ac981011d
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2025.87"
        },
        {
            "last_affected": "2025.87"
        },
        {
            "introduced": "2025.88"
        },
        {
            "last_affected": "2025.88"
        },
        {
            "introduced": "2025.89"
        },
        {
            "last_affected": "2025.89"
        }
    ]
}

Affected versions

2025.*
2025.87
2025.88
2025.89
DROPBEAR_2025.*
DROPBEAR_2025.87
DROPBEAR_2025.88
DROPBEAR_2025.89

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 605.0,
            "function_hash": "213814948035677939021544121219517236664"
        },
        "id": "CVE-2026-3706-0bef24fa",
        "target": {
            "function": "dropbear_ed25519_verify",
            "file": "src/curve25519.c"
        },
        "source": "https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "112220256655486656090191606025939260953",
                "276454567933484885337984990012792280676",
                "91306894696134992414631438177588220079",
                "132864368077499674925325667809892516326",
                "252642720523952594901071120225862025929",
                "65629044967754013180717541473774794045"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-3706-ffd293fb",
        "target": {
            "file": "src/curve25519.c"
        },
        "source": "https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3706.json"
vanir_signatures_modified 
"2026-08-12T16:23:54Z"