cggmp21 vulnerabilities

2 known vulnerabilities in cggmp21 from LFDT-Lockness. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  cggmp21: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2025-66017Nov 25, 2025LFDT-Lockness

  CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used

• 9.3 Critical severity

  cggmp21: Insufficient Verification of Data Authenticity

  CVE-2025-66016Nov 25, 2025LFDT-Lockness

  CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which singl