Skip to main content

Improper Validation of Specified Type of Input

CVE-2025-8556

High
9.9/10

Summary

A vulnerability in Cloudflare's CIRCL implementation of FourQ, affecting versions prior to 1.6.1, fails to validate user-supplied low-order points during Diffie-Hellman key exchange. An attacker could supply a crafted point to force the identity element or trigger incorrect behavior in point equality checks "isEqual", compromising session security and integrity. Moreover, there is an incorrect point validation in "ScalarMult" that can lead to incorrect results in the "isEqual" function and if a point is on the curve. The issue is resolved in version 1.6.1, which adds proper validation of group elements.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-1287 - Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References

Advisory Timeline

  • Published