CVE-2025-8556
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
Risk Assessment
An attacker can compromise session confidentiality and potentially recover key information. The risk affects systems using this implementation for key exchange.
Recommendation
Update the CIRCL library to a patched version. Verify that applications using FourQ perform proper point validation.
Other vulnerabilities in CIRCL
Original NVD description (English source)
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS