CVE-2026-26958

golang-filippo-edwards25519: filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptogra...

CVE-2026-26958 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2026-26958, released February 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
n/a
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0042
36th percentile

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Where it's fixed

ProductFixed inFixReleased
Linux
alloy · sles 15.7 1.16.1-150700.15.20.1 SUSE-SU-2026:2438-1 Jun 17, 2026
cosign · opensuse-leap 15.6 3.0.5-150400.3.35.1 SUSE-SU-2026:0777-1 Mar 3, 2026
cosign · opensuse-leap 16.0 3.0.5-160000.1.1 OPENSUSE-SU-2026:20386-1 Mar 18, 2026
cosign · sles 15.7 3.0.5-150400.3.35.1 SUSE-SU-2026:0777-1 Mar 3, 2026
cosign · sles 16.0 3.0.5-160000.1.1 SUSE-SU-2026:20904-1 Mar 18, 2026
golang-filippo-edwards25519 · Debian 14 1.2.0-1 DEBIAN-CVE-2026-26958 Feb 19, 2026
govulncheck-vulndb · opensuse-leap 15.6 0.0.20260226T182644-150000.1.149.1 SUSE-SU-2026:0757-1 Mar 3, 2026
govulncheck-vulndb · opensuse-leap 16.0 0.0.20260723T184607-160000.1.1 OPENSUSE-SU-2026:21483-1 Jul 30, 2026
grafana · opensuse-leap 16.0 11.6.14+security04-bp160.1.1 OPENSUSE-SU-2026:20940-1 Jun 10, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.