CVE-2025-8556
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
- Score
- CVSS 3.1 3.7 Low
- Status
- Deferred - secalert@redhat.com
- Published
- 2025-08-06
- Last modified
- 2026-10-27
- Weaknesses
- CWE-1287
Affected products
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Ceph Storage (Redhat)
- Container Native Virtualization (Redhat)
- Devworkspace (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Multicluster Globalhub (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Builds (Redhat)
- Openshift Custom Metrics Autoscaler (Redhat)
- Openshift Gitops (Redhat)
- Openshift Pipelines (Redhat)
- Openstack (Redhat)
- Rhdh (Redhat)
- Serverless (Redhat)
- Service Mesh (Redhat)
- Trusted Application Pipeline (Redhat)
- Trusted Artifact Signer (Redhat)
- Trusted Profile Analyzer (Redhat)
- Windows Machine Config (Redhat)
References
- https://access.redhat.com/security/cve/CVE-2025-8556
- https://bugzilla.redhat.com/show_bug.cgi?id=2371624
- https://github.com/cloudflare/circl
- https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm
- https://github.com/cloudflare/circl/tree/v1.6.1
- https://www.botanica.software/blog/cryptographic-issues-in-cloudflares-circl-fourq-implementation
- https://news.ycombinator.com/item?id=45669593
