CVE-2026-1229

Executive Summary

CVE-2026-1229 is a computational correctness vulnerability in the Cloudflare Interoperable Reusable Cryptographic Library (CIRCL), specifically within the CombinedMult function of the ecc/p384 package for the secp384r1 (P-384) elliptic curve. The function produces an incorrect value for specific inputs due to the use of incomplete addition formulas. The vulnerability does not affect ECDH or ECDSA signing operations that rely on this curve. The issue has been patched in CIRCL version 1.6.3 by implementing complete addition formulas.

Supply Chain & Package Security

This vulnerability affects the Go package github.com/cloudflare/circl. Any application or service that imports this library and uses the CombinedMult function on the P-384 curve with specific inputs could produce incorrect cryptographic results. This could lead to subtle failures in protocols or systems that depend on the correctness of this operation, such as custom key exchange or signature verification schemes that directly call CombinedMult. The Go module ecosystem is impacted, and downstream dependencies must update to version 1.6.3 or later.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored) CVSS Vector: UNKNOWN

The NVD has not assigned a CVSS score. The vulnerability is a correctness bug rather than a security flaw exploitable for direct compromise. However, incorrect cryptographic outputs can lead to denial of service, protocol failures, or bypass of security controls in systems that rely on the exact output of CombinedMult. The threat level is considered Low due to the specific conditions required and the lack of impact on standard ECDH/ECDSA operations.

Deep Dive & Mechanics

The CombinedMult function in the CIRCL library is used to compute a combined scalar multiplication on an elliptic curve, typically for operations like verifying ECDSA signatures or performing key exchange. The P-384 curve (secp384r1) is a NIST-standardized curve used in high-security applications.

The vulnerability arises from the use of incomplete addition formulas in the point arithmetic. In elliptic curve cryptography, point addition and doubling formulas can have special cases (e.g., adding a point to itself, adding the point at infinity, or adding points that are inverses of each other). Incomplete formulas do not handle these edge cases correctly, leading to incorrect results for specific inputs.

The CombinedMult function, when given certain combinations of scalars and points, would produce an incorrect output due to these edge cases not being properly handled. The fix replaces the incomplete formulas with complete addition formulas, which correctly handle all possible inputs, including the point at infinity and doubling cases.

The bug does not affect standard ECDH or ECDSA because those protocols use different code paths (e.g., ScalarMult or ScalarBaseMult) that either already use complete formulas or are not triggered by the specific inputs that cause the bug.

Vulnerable vs. Patched Code

Vulnerable Code (CIRCL < 1.6.3): The CombinedMult function in ecc/p384 used incomplete addition formulas. The exact vulnerable code is not publicly disclosed, but the issue is in the point addition logic.

// Vulnerable: Uses incomplete addition formulas
func (p *P384Point) CombinedMult(scalar1, scalar2 []byte, point *P384Point) (*P384Point, error) {
    // ... implementation using incomplete formulas
    // This can produce incorrect results for specific inputs
}

Patched Code (CIRCL >= 1.6.3): The fix replaces the incomplete formulas with complete addition formulas that handle all edge cases.

// Patched: Uses complete addition formulas
func (p *P384Point) CombinedMult(scalar1, scalar2 []byte, point *P384Point) (*P384Point, error) {
    // ... implementation using complete formulas
    // Correctly handles all inputs including point at infinity and doubling
}

The patch was released in version 1.6.3. The specific commit can be found in the CIRCL repository.

Exploitation & Lab Setup

Red Team

Exploitation of this vulnerability is not straightforward as it does not allow for direct code execution or data exfiltration. However, an attacker could craft specific inputs to the CombinedMult function to cause incorrect cryptographic results. This could be used to:

1. Denial of Service: Cause a protocol to fail by producing an unexpected output.
2. Protocol Bypass: If a custom protocol relies on the correctness of CombinedMult for authentication or integrity, an attacker could potentially bypass these checks by providing inputs that trigger the bug.

Lab Setup:

1. Set up a Go environment with CIRCL version 1.6.2 or earlier.
2. Create a test program that calls CombinedMult with specific inputs known to trigger the bug (if such inputs are discovered through fuzzing or analysis).
3. Observe the incorrect output and compare it to the expected correct output from the patched version.

package main

import (
    "fmt"
    "github.com/cloudflare/circl/ecc/p384"
)

func main() {
    // Example: Create a point and scalars that trigger the bug
    // (Specific values would need to be found through analysis)
    point := new(p384.P384Point)
    // ... set point coordinates
    scalar1 := []byte{...}
    scalar2 := []byte{...}
    result, err := point.CombinedMult(scalar1, scalar2, point)
    if err != nil {
        fmt.Println("Error:", err)
    }
    fmt.Println("Result:", result)
}

Blue Team

Detection of exploitation attempts is difficult because the vulnerability does not leave obvious traces. However, blue teams should:

1. Inventory: Identify all applications and services using the CIRCL library, especially those that call CombinedMult on the P-384 curve.
2. Update: Ensure all instances of CIRCL are updated to version 1.6.3 or later.
3. Monitor: Look for unusual cryptographic errors or failures in systems that use P-384 operations.
4. Fuzz Testing: Perform fuzz testing on any custom protocols that use CombinedMult to identify potential edge cases.

Indicators of Compromise (IOCs)

• Library Version: github.com/cloudflare/circl version < 1.6.3
• Function Call: Use of CombinedMult method on P384Point objects
• Error Logs: Cryptographic errors or unexpected results from P-384 operations
• Network Traffic: Unusual patterns in protocols that rely on P-384 combined multiplication

Detection Engineering

YARA Rule

rule CVE_2026_1229_CIRCL_P384_CombinedMult {
    meta:
        description = "Detects vulnerable CIRCL library versions with incomplete addition formulas in CombinedMult"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-1229"
        hash = "unknown"
    strings:
        $vuln_func = "CombinedMult" nocase
        $p384_ref = "ecc/p384" nocase
        $incomplete_formula = "add" nocase
    condition:
        $vuln_func and $p384_ref and #incomplete_formula > 0
}

Sigma Rule

title: CVE-2026-1229 - CIRCL P-384 CombinedMult Vulnerability
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation attempts of CVE-2026-1229 by monitoring for cryptographic errors related to P-384 combined multiplication.
author: Valters IT
date: 2026/01/01
logsource:
    category: application
    product: custom
detection:
    selection:
        - "CombinedMult"
        - "P384"
        - "cryptographic error"
    condition: selection
falsepositives:
    - Legitimate use of CombinedMult with correct inputs
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-1229 - CIRCL P-384 CombinedMult Vulnerability"; flow:to_server; content:"CombinedMult"; nocase; content:"P384"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update the CIRCL library to version 1.6.3 or later.

   go get github.com/cloudflare/circl@v1.6.3
   

2. Verify: Ensure that all dependencies are updated and that the vulnerable function is no longer in use.
3. Monitor: Review logs for any cryptographic errors that may indicate exploitation attempts.
4. Audit: Conduct a code review to identify any custom implementations that may rely on the vulnerable function.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert