CVE-2026-22866

The CVE describes a critical flaw in Ethereum Name Service (ENS) contracts prior to 1.6.2 where RSASHA256Algorithm and RSASHA1Algorithm fail to properly validate PKCS#1 v1.5 padding, checking only the trailing hash instead of full padding. This enables Bleichenbacher-style signature forgery again...

PT-2026-21935

Name of the Vulnerable Software and Affected Versions Ethereum Name Service ENS versions 1.6.2 and prior Description The RSASHA256Algorithm and RSASHA1Algorithm contracts do not properly validate PKCS1 v1.5 padding when verifying RSA signatures. The contracts only verify the final 32 or 20 bytes ...