CVE-2026-115408

The github.com/eclipse-keypont/crypto11/v2 library (versions >= 2.0.0-rc3,

CVE-2026-115408 ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

In github.com/eclipse-keypont/crypto11/v2 versions = 2.0.0-rc3, = 2.0.0-rc8, the ML-KEM key-pair lookup functions FindMLKEMKeyPair, FindMLKEMKeyPairs, FindMLKEMKeyPairsWithAttributes locate the public half of an ML-KEM key pair by CKAID/CKALABEL and never verify it against the private key. In...

PT-2026-126389

In github.com/eclipse-keypont/crypto11/v2 versions = 2.0.0-rc3, = 2.0.0-rc8, the ML-KEM key-pair lookup functions FindMLKEMKeyPair, FindMLKEMKeyPairs, FindMLKEMKeyPairsWithAttributes locate the public half of an ML-KEM key pair by CKA ID/CKA LABEL and never verify it against the private key. In...