CVE-2026-55174
- Source
- https://cve.org/CVERecord?id=CVE-2026-55174
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55174.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55174
- Aliases
-
- GHSA-c7q2-gv3g-rgxm
- Published
- 2026-09-30T15:49:10Z
- Modified
- 2026-10-02T08:14:54Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding
- Details
-
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-345", "CWE-347" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55174.json" }- References
-
- https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.0
- https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55174.json
- https://github.com/shrec/UltrafastSecp256k1/security/advisories/GHSA-c7q2-gv3g-rgxm
- https://nvd.nist.gov/vuln/detail/CVE-2026-55174
- https://github.com/shrec/UltrafastSecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981
Affected packages
Git / github.com/shrec/ultrafastsecp256k1
Affected ranges
- Type
- GIT
- Repo
- https://github.com/shrec/ultrafastsecp256k1
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "4.2.0" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v0.*
v0.1.0
v2.*
v2.0.0
v2.0.1
v2.1.0
v3.*
v3.0.0
v3.10.0
v3.11.0
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.13.0
v3.13.1
v3.15.3
v3.19.0
v3.20.1
v3.21.0
v3.21.1
v3.4.0
v3.5.0
v3.50.0
v3.6.0
v3.60
v3.61
v3.62.0
v3.63.0
v3.64.0
v3.66.0
v3.68.0
v3.7.0
v3.8.0
v3.9.0
v4.*
v4.1.1
v4.2.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55174.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "206216149320354251081536307564729272708",
"length": 1512
},
"id": "CVE-2026-55174-11bf82ab",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_secret_stack_residue_v9.cpp",
"function": "test_ecdsa_adaptor_degenerate_r_erases"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182173251073439958831272453218818091137",
"length": 1356
},
"id": "CVE-2026-55174-132270d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/impl/ufsecp_zk.cpp",
"function": "ufsecp_ecdsa_adaptor_sign"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "150080244148528278745293264376340611188",
"length": 563
},
"id": "CVE-2026-55174-2d9e7e4c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_adaptor_binding_domain.cpp",
"function": "test_adb_5"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206842088716574266037464071396470158806",
"length": 1017
},
"id": "CVE-2026-55174-35a1efa4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/adaptor.cpp",
"function": "ecdsa_adaptor_binding"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "43599842043002519874607794728020428061",
"length": 1091
},
"id": "CVE-2026-55174-35ba1920",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/impl/ufsecp_zk.cpp",
"function": "ufsecp_ecdsa_adaptor_adapt"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141654075489568568440270200621233182816",
"221114971863204700386630219553735060068",
"290403171405656657749108615349557151420",
"126464476495548673811551686615249277142",
"81043632580877764909249695455507368296",
"323984346318856427711623481324704978428",
"197819938476451988735404275831489679170",
"177644628134579913758530893888904503216",
"197785879733699703551199668969101976547",
"265199645512666619707588707362273172141",
"152675932947007362589216072419352450793",
"181607918641929175480066352839335105765",
"7992929223851191477638407212464521404",
"141254222933406612455589080841491815160",
"72585708152270098324593264827810816269",
"212913038940850451565425343290834198524",
"152096897652941219173958240682950823142",
"148213515308501753786879040651257848859",
"86447316164167752559086983157659435530",
"96879801356067861546628842600464400991",
"145468926319594828329199965465805020434",
"39751919300466652534490784162868087426",
"84072055754133008328363919156166618841",
"327755662760696096746495759431778491981",
"129307389690352400023649316992194696441",
"230277850995613092462083489580620818808",
"189216414000531235262348689637918056836",
"200651697663344427101075058178701252772",
"236522102561469578324777418213522598143",
"267578532103118005105495483098295086235",
"204110082463083873115092452373443192331",
"258273255406661684733045715955220596165",
"243708421677739060332769475299400455256",
"194130546639614631508027184129850283360",
"104266659763712787942781154962137524576",
"231457181945647284625337463171312977356",
"132777720848152986560793954557697436661",
"63369209156521660980403368768798661764",
"181592269930888947720170571233635139670"
],
"threshold": 0.9
},
"id": "CVE-2026-55174-5d59fa51",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_adaptor_binding_domain.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "53695060424819354304125738733760356524",
"length": 873
},
"id": "CVE-2026-55174-64d85578",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_adaptor_binding_domain.cpp",
"function": "test_adb_6"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "261430083110634452264058931488630163180",
"length": 400
},
"id": "CVE-2026-55174-94f1170c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_adaptor_binding_domain.cpp",
"function": "test_regression_adaptor_binding_domain_run"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"287153872294356892630764685667045269705",
"978998097458749562964438635433972742",
"240873290493454681456888621609973794602",
"190825929107575892435691421524245846668",
"307564774288545214543964496380628359817",
"243890613024957269183090405774814751766",
"25384665918106302559720500410120690073",
"297140265514811682548997767179019372217",
"218345692645956608181607808164429007145",
"120567722541982752215253816062190426364",
"244829057245551161395584719905177740287",
"93047490678696614709255039350912748829",
"134094112592858837114870682467887095462",
"263712169835418214255647362685224101128",
"270455719295776166596775708389604090150"
],
"threshold": 0.9
},
"id": "CVE-2026-55174-b9c971ac",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_secret_stack_residue_v9.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"318140653169222444933052863098652921377",
"230786794893929892046420520558605475055",
"303837400788088824245721987849507059896",
"242110569653893269638455022368381359218",
"164246871748677722158573145834147635946",
"34637523361714035101287791854274607245"
],
"threshold": 0.9
},
"id": "CVE-2026-55174-c69c5c8e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_ct_ops.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"101142015134399660842815899992866417159",
"103049708089146890996557050872975371843",
"154714218692427643038383143939091937911",
"26439311570538632757713545889924716730",
"262292103865367166986903562676301775535",
"244452956936838193357677602439698783051",
"68212741552437124067193660908946279029",
"13800972965626784530299787930261532410",
"133391384909916347223155052003565324637",
"182851945830771406238120307143009126616",
"83824083639845793309336910419947895140",
"231740891595591296305611077255621056194",
"74972474599940836862144630260571716365",
"254030331807817545277633712203151005494",
"206547439311923096149146691897687093425",
"184000458499347702258626049283199005421",
"223873672692671849076720763148084701947",
"225722497695858767575949408786833441357",
"18326786988656600608318010779376836565",
"79809858032593018742854808595937642577",
"99236933690500201581910706854396506333",
"23998674533795361900216508373340558173",
"129767516254683337206740583262975934273",
"190398745315147432749111083170460012478",
"145106334221954680051513120482675927881",
"34554944213897037732054301762861839501",
"331288423404530567755796719024502122155",
"133142628709167724950512401325867715605",
"28798353994133491671675841074622732409",
"55799899292719673299800990117294893236",
"144844946322119787300252292456629440832",
"119674923544244759531515213959078461454",
"148472125257081079669215316229314656532",
"71082565605628897744916080409212829965",
"48476114339512881932532850161976130428",
"171793772378557000177888050840333363559",
"242702234932297193011966408759240152586",
"172181119416452827924023489735962813821",
"308712425325992785259876270181498911638",
"137407171883947245911353531075176520170",
"252135124933995559906156219050340036431",
"271626766717602658635824395615445323684",
"219797361195996251997168601269671622409",
"97952555235908411532127721017005743117",
"106542379412444027928304030680670913603",
"238632933104586132202191697458873046569",
"34707354520528836004706398276834857447",
"135031292964867672047642206911487969915",
"70752979393178491409960474375535137379",
"237527656485529511899456026673745027149",
"226625092383381494010865876223504729654",
"205093050815975004527648486154721584443",
"288878871909868728967813757723038404484",
"24643602091918793188159166082603128896",
"46902981749979199427520064137900265029",
"201639539247102471929207032974571661420",
"110454851452763535448158351414925877623",
"76177448281732409465944927308219217682",
"221066339440473165798648156974018707032",
"332697905911466979608688408683769222837",
"104389103246677416932153601830385383848",
"19455231392289137484939680465326863284",
"8300386452589466486669484339431656768",
"224397906321544668853931226024685619000",
"271348001077681582618287907096497376521",
"9969661598623476327113854266243123081",
"303041562778595865032848602909336916093",
"193846477731127546722030499918470122755",
"44655896008024605821010041917513804136",
"191328272066240261840438186382456569571",
"597610015737240625770122150134407263",
"321197285683132965867683395523083625287",
"141130888627657258323068036025608658770"
],
"threshold": 0.9
},
"id": "CVE-2026-55174-d2ddcd75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/adaptor.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "244927814841322914618962342751532982905",
"length": 1267
},
"id": "CVE-2026-55174-d6e42c6a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/impl/ufsecp_zk.cpp",
"function": "ufsecp_ecdsa_adaptor_extract"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262063660362888160623013406365442784438",
"length": 1329
},
"id": "CVE-2026-55174-db4cde6f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/impl/ufsecp_zk.cpp",
"function": "ufsecp_ecdsa_adaptor_verify"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"12421721683446227177706729529903222456",
"170031112200243660697323423999099041768",
"210329062746460071751647288749267826102",
"268708252366566678862733421907497544890",
"161756260895817753075563913218334264093",
"169201759396779613001320841035397254688",
"34753076886466566481308278494407185778",
"293571916689014696100812116135742273939",
"130694261000522629574834575991147144721",
"132497296259470760276537092876557683229",
"168994364015774591737598298483160519547",
"63910777680978383772023998815873995722",
"44728634603187570715075872265782566064",
"24202195511681323681854670037642537113",
"237467287827928618122144573715530503140",
"82492167443960552587991031672020929917",
"13883320229512700767950450346375238946",
"308970695395416253028978676394301950484",
"24323937968540558375276172951603232577",
"330945822746798008816087599221009159895",
"338460608595587075445806403508778309930",
"284600514281915388860993069267748404504",
"201777936509320553990488994499225599675",
"195885920841414276451989733358188603069",
"332155121627627245583557966555280658701",
"333915820784118295421531012556099066461",
"130202590776632741819749769721599616112",
"243190765246842370219349780797403490042",
"145860836865434086114690449875715316316",
"7189363087459592058854497606957911078",
"302627838986473240545041776005899557962",
"308970695395416253028978676394301950484",
"24323937968540558375276172951603232577",
"330945822746798008816087599221009159895",
"338460608595587075445806403508778309930",
"284600514281915388860993069267748404504",
"201777936509320553990488994499225599675",
"195885920841414276451989733358188603069",
"332155121627627245583557966555280658701",
"333915820784118295421531012556099066461",
"130202590776632741819749769721599616112",
"243190765246842370219349780797403490042",
"4252748855431899271769981700005840852",
"255546379183655427519635446332539380502",
"262098720913128506863410985990651105248",
"308970695395416253028978676394301950484",
"24323937968540558375276172951603232577",
"330945822746798008816087599221009159895",
"338460608595587075445806403508778309930",
"284600514281915388860993069267748404504",
"201777936509320553990488994499225599675",
"195885920841414276451989733358188603069",
"332155121627627245583557966555280658701",
"333915820784118295421531012556099066461",
"130202590776632741819749769721599616112",
"243190765246842370219349780797403490042",
"188113843366568834349036071147456432820",
"110076186086717867140569460609943140533"
],
"threshold": 0.9
},
"id": "CVE-2026-55174-df8fc56f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/src/impl/ufsecp_zk.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211206209927248442725419291343162119929",
"37588599783803255039926928169619322922",
"23735116190889112224948722854196897912",
"112506058962026945546785069988854942634",
"234851894610416276896059690697711514155",
"233552437408374714353865788070083326843",
"55462491340161576453222832270007980312"
],
"threshold": 0.9
},
"id": "CVE-2026-55174-e027f98c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "src/cpu/include/secp256k1/adaptor.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "245936384190118242763864131905775688226",
"length": 1166
},
"id": "CVE-2026-55174-eb8aec17",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/shrec/ultrafastsecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981",
"target": {
"file": "audit/test_regression_ct_ops.cpp",
"function": "test_sec008_adaptor_sentinel"
}
}
]
vanir_signatures_modified
"2026-10-02T08:14:54Z"