CVE-2026-54872— Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
Quick assessment
Affected
OpenSSL OpenSSL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to mea
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54872
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
Source: CVE Program / CVE List V5
Vulnerability Description
Issue summary: The generic elliptic-curve scalar multiplication used for
ECDSA and SM2 signature operations with curves that do not have a dedicated
implementation leaks information about the secret nonce through timing.
Impact summary: An attacker able to measure signing times may learn
information about the per-signature secret nonce, which over many signatures
can, via a lattice / Hidden Number Problem attack, lead to recovery of the
private key.
CWE: CWE-208: Observable Timing Discrepancy
Description: The generic elliptic-curve scalar multiplication used for
curves that do not have a dedicated constant-time implementation pads the
secret scalar with non-constant-time BIGNUM operations, so the time taken
depends on the value of the secret scalar derived from the ECDSA and SM2 nonce.
The leak is very small; observing it requires a large number of
measurements. The effect is largest for curves whose group order lies
on a machine-word boundary, such as brainpoolP384r1.
Applications using ECDSA signing over the Brainpool and other generic prime
curves, and SM2 signing on platforms that use the generic implementation,
are vulnerable to this issue.
The NIST curves P-256, P-384 and P-521 use dedicated constant-time
implementations and are not affected.
FIPS Impact: no
The FIPS modules are not affected: the approved NIST curves used in the FIPS
provider have dedicated constant-time implementations and do not use the
affected code path.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-54872
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54872
请登录查看更多情报信息。
Other References for CVE-2026-54872 (5)
-
https://openssl-library.org/news/secadv/20260929.txt vendor-advisory
Same Patch Batch · OpenSSL · 2026-09-29 · 14 CVEs total
| CVE-2026-35189 | Excessive Memory Allocation in Relative CRLDP Processing | |
| CVE-2026-35191 | QUIC Unvalidated Amplification Credit may be Over Accounted | |
| CVE-2026-75806 | Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS | |
| CVE-2026-75804 | QUIC Connection-Level Flow Control is Not Enforced for Streams | |
| CVE-2026-75805 | NULL Pointer Dereference in CMP Client Revocation Response Handling | |
| CVE-2026-42772 | Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC | |
| CVE-2026-54873 | QUIC STREAM Fragment Metadata DoS | |
| CVE-2026-54875 | Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V | |
| CVE-2026-77696 | Timing Side-Channel in SM2 Signature Generation | |
| CVE-2026-72897 | Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake | |
| CVE-2026-84782 | DTLS Retransmits Handshake Messages From a Stale Buffer Offset | |
| CVE-2026-84784 | QUIC: Unbounded RETIRE_CONNECTION_ID Backlog | |
| CVE-2026-84783 | Use-After-Free in X.509 Extension Cache Under Concurrent Use |
IV. Related Vulnerabilities
Same product: OpenSSL
-
CVE-2026-84784
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog -
CVE-2026-84783
Use-After-Free in X.509 Extension Cache Under Concurrent Use -
CVE-2026-84782
DTLS Retransmits Handshake Messages From a Stale Buffer Offs -
CVE-2026-77696
Timing Side-Channel in SM2 Signature Generation -
CVE-2026-75806
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes D
Same vendor: OpenSSL
-
CVE-2026-84784
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog -
CVE-2026-84783
Use-After-Free in X.509 Extension Cache Under Concurrent Use -
CVE-2026-84782
DTLS Retransmits Handshake Messages From a Stale Buffer Offs -
CVE-2026-77696
Timing Side-Channel in SM2 Signature Generation -
CVE-2026-75806
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes D
Same weakness: CWE-208
-
CVE-2026-77696
Timing Side-Channel in SM2 Signature Generation -
CVE-2026-54875
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RIS -
CVE-2026-63132
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timi -
CVE-2026-85725
LightRAG: Plaintext Passwords Compared Without Constant-Time -
CVE-2026-88010
Traefik: BasicAuth singleflight coalescing reintroduces an u
V. Comments for CVE-2026-54872
No comments yet