DEBIAN-CVE-2026-3706

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-3706
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3706.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-3706
Upstream
Published
2026-03-08T05:16:31.847Z
Modified
2026-03-19T18:00:12.326075Z
Severity
  • 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch. The project maintainer explains: "Signature Malleability is not exploitable in SSH protocol. (...) [A] PoC doesn't exist for SSH implementation, but rather it's against the internal API."

References

Affected packages

Debian:11 / dropbear

Package

Name
dropbear
Purl
pkg:deb/debian/dropbear?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2020.*
2020.81-3
2020.81-3+deb11u1
2020.81-3+deb11u2
2020.81-3+deb11u3
2020.81-4
2020.81-5
2022.*
2022.82-1
2022.82-2
2022.82-3
2022.82-4
2022.82-4.1~bpo11+1
2022.82-4.1
2022.83-1~bpo11+1
2022.83-1
2022.83-2
2022.83-3
2022.83-4
2024.*
2024.84-1
2024.85-1
2024.85-2
2024.85-3
2024.86-1
2024.86-2
2025.*
2025.87-1
2025.88-1
2025.88-2
2025.89-1~deb13u1
2025.89-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3706.json"

Debian:12 / dropbear

Package

Name
dropbear
Purl
pkg:deb/debian/dropbear?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2022.*
2022.83-1
2022.83-1+deb12u1~bpo11+1
2022.83-1+deb12u1
2022.83-1+deb12u2
2022.83-1+deb12u3
2022.83-2
2022.83-3
2022.83-4
2024.*
2024.84-1
2024.85-1
2024.85-2
2024.85-3
2024.86-1
2024.86-2
2025.*
2025.87-1
2025.88-1
2025.88-2
2025.89-1~deb13u1
2025.89-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3706.json"

Debian:13 / dropbear

Package

Name
dropbear
Purl
pkg:deb/debian/dropbear?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.88-2
2025.89-1~deb13u1
2025.89-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3706.json"

Debian:14 / dropbear

Package

Name
dropbear
Purl
pkg:deb/debian/dropbear?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.88-2
2025.89-1~deb13u1
2025.89-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3706.json"