Public Key Forgery Vulnerability in Mirage Crypto for OCaml
CVE-2026-87733

6.2MEDIUM

Key Information:

Vendor

Ocaml

Status
Mirage-crypto-ec
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87733?

A security flaw exists in the mirage-crypto-ec function in versions prior to 2.2.0 for OCaml. The ECDSA functions, specifically {P256, P384, P521}.Dsa.pub_of_octets, inadvertently accept 0x00, which represents the encoding of the point at infinity, as a valid public key. This oversight allows for the potential forgery of digital signatures without requiring a corresponding private key, posing significant risks to applications reliant on cryptographic integrity.

Affected Version(s)

mirage-crypto-ec 0 < 2.2.0

References

https://osv.dev/vulnerability/OSEC-2026-13

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.