What is GHSA-q9hv-hpm4-hj6x?

GHSA-q9hv-hpm4-hj6x is a security advisory published by GitHub Security Advisories with Low severity. CIRCL has an incorrect calculation in secp384r1 CombinedMult

Which CVE IDs does GHSA-q9hv-hpm4-hj6x cover?

GHSA-q9hv-hpm4-hj6x covers the following CVE IDs: CVE-2026-1229. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q9hv-hpm4-hj6x?

GHSA-q9hv-hpm4-hj6x affects 1 product, including: go/github.com/cloudflare/circl:\u003c 1.6.3.

GHSA-q9hv-hpm4-hj6xLow

CIRCL has an incorrect calculation in secp384r1 CombinedMult

Vendor

GitHub Security Advisories

Published

February 25, 2026

Last Modified

March 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-1229 →

📋 Description

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3.

🎯 Affected products1

go/github.com/cloudflare/circl:< 1.6.3

🔗 References (5)

https://github.com/cloudflare/circl/security/advisories/GHSA-q9hv-hpm4-hj6x
https://nvd.nist.gov/vuln/detail/CVE-2026-1229
https://github.com/cloudflare/circl/pull/583
https://github.com/cloudflare/circl/releases/tag/v1.6.3
https://github.com/advisories/GHSA-q9hv-hpm4-hj6x