Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

ecdsa

4 known vulnerabilities (2 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
0.19.2 (Mar 26, 2026): affected by CVE-2024-23342
Newest unaffected release
Every release is affected by at least one advisory
Advisories
4 · 2 high, 1 medium, 1 low
Weekly downloads
10.2M
Dependents
2,937
Releases
23 since 0.6.0 (Oct 16, 2010)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • CVE-2026-33936Medium 5.3

    python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

    Affected: fixed in 0.19.2.

    Fixed in 0.19.2 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 0.19.2, is not affected.

  • python-ecdsa vulnerable to Minerva attack on P-256

    Affected: all versions.

    No fix released. The latest release, 0.19.2, is still affected.

  • A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding.

    Affected: fixed in 0.13.3; fixed in 0.13.3.

    Fixed in 0.13.3 (released Oct 7, 2019, 87 days before disclosure).

    The latest release, 0.19.2, is not affected.

  • An error-handling flaw was found in python-ecdsa before version 0.13.3.

    Affected: fixed in 0.13.3.

    Fixed in 0.13.3 (released Oct 7, 2019, 50 days before disclosure).

    The latest release, 0.19.2, is not affected.