UBUNTU-CVE-2026-33895

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order S = L. A valid signature and its S + L variant...

Signature Malleability

github.com/consensys/gnark is vulnerable to signature malleability. The vulnerability is due to improper validation of the S value in EdDSA and ECDSA signatures not enforcing 0 ≤ S order, which allows an attacker to create multiple valid signatures for the same public input, potentially enabling...

UBUNTU-CVE-2024-42461

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...

PT-2020-13705 · Elliptic · Elliptic

Name of the Vulnerable Software and Affected Versions: Elliptic package versions prior to 6.5.3 Description: The issue allows ECDSA signature malleability via variations in encoding, leading '0' bytes, or integer overflows. This could have a security-relevant impact if an application relied on a...