Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Summary

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

Timeline

1. Aug 6, 2025, 8:48 AM UTCCVE published
2. Aug 6, 2025, 8:24 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 27, 2026, 5:42 AM UTCRecord last updated

Affected versions

• circl

  fixed in 1.6.1

• openshift-builds/openshift-builds-controller-rhel9

  Version range not reported

• openshift-builds/openshift-builds-git-cloner-rhel9

  Version range not reported

• openshift-builds/openshift-builds-image-bundler-rhel9

  Version range not reported

• openshift-builds/openshift-builds-image-processing-rhel9

  Version range not reported

• openshift-builds/openshift-builds-waiters-rhel9

  Version range not reported

• openshift-builds/openshift-builds-webhook-rhel9

  Version range not reported

• custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9

  Version range not reported

• custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9

  Version range not reported

• custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle

  Version range not reported

• custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9

  Version range not reported

• custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator

  Version range not reported

• multicluster-globalhub/multicluster-globalhub-grafana-rhel9

  Version range not reported

• openshift-pipelines/pipelines-chains-controller-rhel8

  Version range not reported

• openshift-pipelines/pipelines-chains-controller-rhel9

  Version range not reported

• openshift-pipelines/pipelines-cli-tkn-rhel8

  Version range not reported

• openshift-pipelines/pipelines-cli-tkn-rhel9

  Version range not reported

• openshift-pipelines/pipelines-controller-rhel8

  Version range not reported

• openshift-pipelines/pipelines-controller-rhel9

  Version range not reported

• openshift-pipelines/pipelines-entrypoint-rhel8

  Version range not reported

• openshift-pipelines/pipelines-entrypoint-rhel9

  Version range not reported

• openshift-pipelines/pipelines-events-rhel8

  Version range not reported

• openshift-pipelines/pipelines-events-rhel9

  Version range not reported

• openshift-pipelines/pipelines-nop-rhel8

  Version range not reported

• openshift-pipelines/pipelines-nop-rhel9

  Version range not reported

• openshift-pipelines/pipelines-operator-bundle

  Version range not reported

• openshift-pipelines/pipelines-operator-proxy-rhel8

  Version range not reported

• openshift-pipelines/pipelines-operator-proxy-rhel9

  Version range not reported

• openshift-pipelines/pipelines-operator-webhook-rhel8

  Version range not reported

• openshift-pipelines/pipelines-operator-webhook-rhel9

  Version range not reported

• openshift-pipelines/pipelines-resolvers-rhel8

  Version range not reported

• openshift-pipelines/pipelines-resolvers-rhel9

  Version range not reported

• openshift-pipelines/pipelines-rhel8-operator

  Version range not reported

• openshift-pipelines/pipelines-rhel9-operator

  Version range not reported

• openshift-pipelines/pipelines-sidecarlogresults-rhel8

  Version range not reported

• openshift-pipelines/pipelines-sidecarlogresults-rhel9

  Version range not reported

• openshift-pipelines/pipelines-webhook-rhel8

  Version range not reported

• openshift-pipelines/pipelines-webhook-rhel9

  Version range not reported

• openshift-pipelines/pipelines-workingdirinit-rhel8

  Version range not reported

• openshift-pipelines/pipelines-workingdirinit-rhel9

  Version range not reported

• openshift-serverless-1/kn-client-cli-artifacts-rhel8

  Version range not reported

• openshift-serverless-1/kn-client-kn-rhel8

  Version range not reported

• openshift-serverless-1/kn-plugin-event-sender-rhel8

  Version range not reported

• openshift-serverless-1/kn-plugin-func-func-util-rhel8

  Version range not reported

• openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9

  Version range not reported

• openshift-service-mesh/istio-cni-rhel9

  Version range not reported

• openshift-service-mesh/istio-must-gather-rhel9

  Version range not reported

• openshift-service-mesh/istio-pilot-rhel9

  Version range not reported

• openshift-service-mesh/istio-proxyv2-rhel9

  Version range not reported

• openshift-service-mesh/istio-rhel9-operator

  Version range not reported

• openshift-service-mesh/istio-sail-operator-bundle

  Version range not reported

• flightctl

  Version range not reported

• rhacm2/acm-flightctl-api-rhel9

  Version range not reported

• rhacm2/acm-flightctl-periodic-rhel9

  Version range not reported

• rhacm2/acm-flightctl-worker-rhel9

  Version range not reported

• rhacm2/acm-grafana-rhel9

  Version range not reported

• rhacm2/multicluster-operators-subscription-rhel9

  Version range not reported

• rhacm2/subctl-rhel9

  Version range not reported

• rhacm2/volsync-rhel9

  Version range not reported

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-rhel8-operator

  Version range not reported

• advanced-cluster-security/rhacs-roxctl-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-db-slim-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-slim-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-v4-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-v4-rhel8

  Version range not reported

• rhceph/grafana-rhel9

  Version range not reported

• rhel9/grafana

  Version range not reported

• rhceph/grafana-rhel9

  Version range not reported

• rhel9/grafana

  Version range not reported

• rhceph/grafana-rhel9

  Version range not reported

• rhel9/grafana

  Version range not reported

• rhdh-orchestrator-dev-preview-beta/controller-rhel9-operator

  Version range not reported

• rhdh-orchestrator-dev-preview-beta/orchestrator-operator-bundle

  Version range not reported

• flightctl

  Version range not reported

• rhacm2/acm-flightctl-api-rhel9

  Version range not reported

• rhacm2/acm-flightctl-periodic-rhel9

  Version range not reported

• rhacm2/acm-flightctl-worker-rhel9

  Version range not reported

• rhem/flightctl-api-rhel9

  Version range not reported

• rhem/flightctl-cli-artifacts-rhel9

  Version range not reported

• rhem/flightctl-periodic-rhel9

  Version range not reported

• rhem/flightctl-ui-ocp-rhel9

  Version range not reported

• rhem/flightctl-ui-rhel9

  Version range not reported

• rhem/flightctl-worker-rhel9

  Version range not reported

• rhel10/grafana

  Version range not reported

• rhel9/grafana

  Version range not reported

• rhelai1/bootc-amd-rhel9

  Version range not reported

• rhelai1/bootc-aws-nvidia-rhel9

  Version range not reported

• rhelai1/bootc-azure-amd-rhel9

  Version range not reported

• rhelai1/bootc-azure-nvidia-rhel9

  Version range not reported

• rhelai1/bootc-gcp-nvidia-rhel9

  Version range not reported

• rhelai1/bootc-nvidia-rhel9

  Version range not reported

• rhelai1/instructlab-amd-rhel9

  Version range not reported

• rhelai1/instructlab-nvidia-rhel9

  Version range not reported

• rhelai1/pathservice-rhel9

  Version range not reported

• rhelai1/ui-rhel9

  Version range not reported

• rhoai/odh-data-science-pipelines-argo-argoexec-rhel8

  Version range not reported

• rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8

  Version range not reported

• openshift4/o-cloud-manager-operator-bundle

  Version range not reported

• openshift4/o-cloud-manager-rhel9-operator

  Version range not reported

• openshift4/ose-aws-cluster-api-controllers-rhel8

  Version range not reported

• openshift4/ose-aws-cluster-api-controllers-rhel9

  Version range not reported

• openshift4/ose-cluster-api-rhel9

  Version range not reported

• openshift4/ose-cluster-kube-cluster-api-rhel8-operator

  Version range not reported

• openshift4/ose-cluster-kube-cluster-api-rhel9-operator

  Version range not reported

• openshift4/ose-console

  Version range not reported

• openshift4/ose-console-rhel9

  Version range not reported

• openshift4/ose-olm-rukpak-rhel8

  Version range not reported

• openshift4/ose-olm-rukpak-rhel9

  Version range not reported

• devworkspace/devworkspace-operator-bundle

  Version range not reported

• devworkspace/devworkspace-project-clone-rhel9

  Version range not reported

• devworkspace/devworkspace-rhel9-operator

  Version range not reported

• openshift4-wincw/windows-machine-config-operator-bundle

  Version range not reported

• openshift4-wincw/windows-machine-config-rhel9-operator

  Version range not reported

• openshift-gitops-1/argocd-rhel8

  Version range not reported

• openshift-gitops-1/argocd-rhel9

  Version range not reported

• openshift-gitops-1/argo-rollouts-rhel8

  Version range not reported

• openshift-gitops-1/gitops-rhel8

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• rhosp-rhel9/osp-director-agent

  Version range not reported

• rhosp-rhel9/osp-director-downloader

  Version range not reported

• rhosp-rhel9/osp-director-operator

  Version range not reported

• rhosp-rhel9/osp-director-agent

  Version range not reported

• rhosp-rhel9/osp-director-downloader

  Version range not reported

• rhosp-rhel9/osp-director-operator

  Version range not reported

• rhtap-task-runner/rhtap-task-runner-rhel9

  Version range not reported

• rhtas/client-server-rhel9

  Version range not reported

• rhtas/cosign-rhel9

  Version range not reported

• rhtas/createctconfig-rhel9

  Version range not reported

• rhtas/ctlog-managectroots-rhel9

  Version range not reported

• rhtas/fulcio-createcerts-rhel9

  Version range not reported

• rhtas/gitsign-rhel9

  Version range not reported

• rhtas/trillian-createdb-rhel9

  Version range not reported

• rhtas/tuf-server-rhel9

  Version range not reported

• rhtpa/rhtpa-guac-rhel9

  Version range not reported

• github.com/cloudflare/circlGo

  fixed in 1.6.1

References 5