GHSA-fw7p-63qq-7hpr

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on filippo.io/edwards25519 via github.com/go-sql-driver/mysql, you are not affected. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like govulncheck.

Database specific

{
    "nvd_published_at": "2026-02-19T23:16:26Z",
    "severity": "LOW",
    "github_reviewed_at": "2026-02-18T22:37:15Z",
    "cwe_ids": [
        "CWE-665"
    ],
    "github_reviewed": true
}

References

Affected packages

Go / filippo.io/edwards25519

Package

Name: filippo.io/edwards25519; View open source insights on deps.dev
Purl: pkg:golang/filippo.io/edwards25519

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fw7p-63qq-7hpr/GHSA-fw7p-63qq-7hpr.json"