Vulnerability · Published Aug 6, 2025 · Assigned by redhat
CVE-2025-8556Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results
Low 3.7
In plain English
A low-severity security flaw in circl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-cloudflare-circl | no fix listed | DEBIAN-CVE-2025-8556 |
| Debian:13 | golang-github-cloudflare-circl | 1.6.1-1 | DEBIAN-CVE-2025-8556 |
| Debian:14 | golang-github-cloudflare-circl | 1.6.1-1 | DEBIAN-CVE-2025-8556 |
| Go | github.com/cloudflare/circl | 1.6.1 | GO-2025-3754 |
| Go | github.com/cloudflare/circl | 1.6.1 | GHSA-2x5j-vhc8-9cwm |
| Ubuntu:22.04:LTS | golang-github-cloudflare-circl | no fix listed | UBUNTU-CVE-2025-8556 |
| Ubuntu:24.04:LTS | golang-github-cloudflare-circl | no fix listed | UBUNTU-CVE-2025-8556 |
Affected products (as reported)
Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2025-8556 vdb-entry, x_refsource_REDHAT
- RHBZ#2371624 issue-tracking, x_refsource_REDHAT
- https://github.com/cloudflare/circl
- https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm
- https://github.com/cloudflare/circl/tree/v1.6.1
- https://www.botanica.software/blog/cryptographic-issues-in-cloudflares-circl-fourq-implementation
- https://news.ycombinator.com/item?id=45669593