Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55174— UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

Quick assessment

Affected
shrec UltrafastSecp256k1
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

UltrafastSecp256k1 是一个高性能、支持多后端的 secp256k1 引擎，具备可复现的审计证据、兼容性垫片（shims）以及基于配置文件的审查范围。在 4.2.0 版本之前，UltrafastSecp256k1 的 ECDSA 适配器预签名验证机制会接受伪造的适配器预签名，其中“r”值未在密码学上与适配器点 “T” 绑定。该问题已在 4.2.0 版本中修复。

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1562.009
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55174

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding
Source: CVE Program / CVE List V5
Vulnerability Description
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shrec UltrafastSecp256k1 < 4.2.0 -

II. Public POCs for CVE-2026-55174

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55174

请登录查看更多情报信息。

Other References for CVE-2026-55174 (4)

IV. Related Vulnerabilities

Same weakness: CWE-345

V. Comments for CVE-2026-55174

No comments yet

Leave a comment