CIRCL vulnerabilities

2 known vulnerabilities in CIRCL from Cloudflare. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  CIRCL: Incorrect Calculation

  CVE-2026-1229Feb 24, 2026Cloudflare

  The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed

• 8.2 High severity

  CIRCL: Improper Handling of Exceptional Conditions

  CVE-2023-1732May 10, 2023Cloudflare

  When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared secret. T