{
  "cveId": "CVE-2026-33936",
  "url": "https://patchblox.com/security/cve/CVE-2026-33936",
  "summary": "CVE-2026-33936 is fixed in python-ecdsa on 1 platform, first by DEBIAN-CVE-2026-33936, released March 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-ecdsa: The \u0060ecdsa\u0060 PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA...",
  "description": "The \u0060ecdsa\u0060 PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. \u0060ecdsa.der.remove_octet_string()\u0060 accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is parsed successfully instead of being rejected. Because of that, a crafted DER input can cause \u0060SigningKey.from_der()\u0060 to raise an internal exception (\u0060IndexError: index out of bounds on dimension 1\u0060) rather than cleanly rejecting malformed DER (e.g., raising \u0060UnexpectedDER\u0060 or \u0060ValueError\u0060). Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service. Version 0.19.2 patches the issue.",
  "published": "2026-03-27T23:17:13Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "epss": 0.00485,
  "epssPercentile": 0.41985,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-ecdsa",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.19.1-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-33936",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33936",
      "released": "2026-03-27T23:17:13Z"
    },
    {
      "platform": "linux",
      "product": "python-ecdsa",
      "release": "Debian 14",
      "fixedVersion": "0.19.2-1",
      "fix": "DEBIAN-CVE-2026-33936",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33936",
      "released": "2026-03-27T23:17:13Z"
    },
    {
      "platform": "linux",
      "product": "python-ecdsa",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.18.0-150400.12.6.1",
      "fix": "SUSE-SU-2026:1436-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1436-1",
      "released": "2026-04-17T12:51:27Z"
    },
    {
      "platform": "linux",
      "product": "python-ecdsa",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.19.1-160000.4.1",
      "fix": "OPENSUSE-SU-2026:21078-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21078-1",
      "released": "2026-06-18T09:36:30Z"
    },
    {
      "platform": "linux",
      "product": "python-ecdsa",
      "release": "sles 15.7",
      "fixedVersion": "0.13.3-150000.3.10.1",
      "fix": "SUSE-SU-2026:1608-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1608-1",
      "released": "2026-04-24T11:51:39Z"
    },
    {
      "platform": "linux",
      "product": "python-ecdsa",
      "release": "sles 16.0",
      "fixedVersion": "0.19.1-160000.4.1",
      "fix": "SUSE-SU-2026:22158-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22158-1",
      "released": "2026-06-18T09:37:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}