Native C secp256k1 Implementation Vulnerability in Ruby Product by secp256k1-native

CVE-2026-63410

What is CVE-2026-63410?

The secp256k1-native library for Ruby is affected by a vulnerability that can expose sensitive timing information during scalar multiplication operations. When the library is compiled with specific GCC toolchains, the implementations of constant-time scalar multiplication may inadvertently leak timing information about secret scalars due to branch reconstructions in the compiled binary. An attacker observing the timing responses can exploit this flaw to recover private keys or nonces through repeated measurements. This vulnerability affects versions of secp256k1-native before 0.18.0, which addresses this issue comprehensively. Affected users should upgrade to the latest version to mitigate this risk.

References