CVE-2025-8556: aactl

CVSS: 3.7v3.1LowDeferred

AliasesUBUNTU-CVE-2025-8556DEBIAN-CVE-2025-8556CGA-28jf-cmwf-59xj+925 more

Published 06-08-2025Last modified 25-02-2026

Vulnerability summary

CVE-2025-8556 is a low (CVSS 3.7) vulnerability in aactl. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.6% of scored vulnerabilities.

Overall risk

15/100

0100

Low · default modelHow is this calculated?

CVSS score

3.7/10

010

Low · v3.1 (CVE.org)

EPSS score

0.50%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 6

OPENSUSE-SU-2026:10013-1 SUSE-SU-2026:0439-1 CGA-2W9C-PHQ9-XM8H CGA-R4Q4-2C54-FFM9 CGA-WW86-2QVQ-H5QH CGA-XR8M-8R43-9QHG

Timeline

06-08-2025
PublishedVulnerability first disclosed.
25-02-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

CVSS metrics

7 scores · 7 sources · 1 version

v3.13.7

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

+0.02 pp

From 0.48% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-1287Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Affected systems

Chainguard200 products

aactl< 0.4.12-r32
actions-runner-controller< 0.11.0-r3
actions-runner-controller-compat< 0.11.0-r3
actions-runner-controller-fips< 0.11.0-r3
actions-runner-controller-fips-compat< 0.11.0-r3

argo-cd-2.11< 2.11.13-r9
argo-cd-2.13< 2.13.8-r1
argo-cd-2.13-compat< 2.13.8-r1
argo-cd-2.13-repo-server< 2.13.8-r1
argo-cd-2.14< 2.14.14-r1
argo-cd-2.14-compat< 2.14.14-r1
argo-cd-2.14-repo-server< 2.14.14-r1
argo-cd-3.0< 3.0.6-r1
argo-cd-3.0-compat< 3.0.6-r1
argo-cd-3.0-iamguarded-compat< 3.0.6-r1
argo-cd-3.0-repo-server< 3.0.6-r1
argo-cd-fips-2.14< 2.14.14-r1
argo-cd-fips-2.14-compat< 2.14.14-r1
argo-cd-fips-2.14-repo-server< 2.14.14-r1
argo-cd-fips-3.0< 3.0.6-r1
argo-cd-fips-3.0-compat< 3.0.6-r1
argo-cd-fips-3.0-iamguarded-compat< 3.0.6-r1
argo-cd-fips-3.0-repo-server< 3.0.6-r1
argo-events< 1.9.6-r3
argo-events-fips< 1.9.6-r4
argo-rollouts< 1.8.3-r1
argo-rollouts-fips< 1.8.3-r1
argo-workflow-cli-3.6< 3.6.11-r1
argo-workflow-cli-fips-3.6< 3.6.11-r1
argo-workflow-controller-3.6< 3.6.11-r1
argo-workflow-controller-3.6-compat< 3.6.11-r1
argo-workflow-controller-3.6-compat-fips< 3.6.11-r1
argo-workflow-controller-fips-3.6< 3.6.11-r1
argo-workflow-executor-3.6< 3.6.11-r1
argo-workflow-executor-3.6-compat< 3.6.11-r1
argo-workflow-executor-3.6-compat-fips< 3.6.11-r1
argo-workflow-executor-fips-3.6< 3.6.11-r1
argo-workflows< 3.6.10-r1
argo-workflows-3.6< 3.6.11-r1
argo-workflows-fips-3.6< 3.6.11-r1
argo-workflows-known-hosts-3.6< 3.6.11-r1
argo-workflows-known-hosts-fips-3.6< 3.6.11-r1
argo-workflows-ui-3.6< 3.6.11-r1
argocd-image-updater< 0.16.0-r4
argocd-image-updater-compat< 0.16.0-r4
argocd-image-updater-fips< 0.16.0-r5
atlantis< 0.34.0-r3
atlantis-fips< 0.34.0-r4
buildkitd< 0.26.0-r1
buildkitd-fips< 0.26.0-r1
caddy< 2.10.0-r1
caddy-fips< 2.10.0-r1
caddy-man< 2.10.0-r1
caddy-src< 2.10.0-r1
cluster-api-1.7< 1.7.9-r3
cluster-api-1.7-capd-manager< 1.7.9-r3
cluster-api-1.7-capd-manager-compat< 1.7.9-r3
cluster-api-1.7-clusterctl< 1.7.9-r3
cluster-api-1.7-clusterctl-compat< 1.7.9-r3
cluster-api-1.7-controller< 1.7.9-r3
cluster-api-1.7-controller-compat< 1.7.9-r3
cluster-api-1.7-kubeadm-bootstrap-controller< 1.7.9-r3
cluster-api-1.7-kubeadm-bootstrap-controller-compat< 1.7.9-r3
cluster-api-1.7-kubeadm-control-plane-controller< 1.7.9-r3
cluster-api-1.7-kubeadm-control-plane-controller-compat< 1.7.9-r3
cluster-api-1.8< 1.8.12-r1
cluster-api-1.8-capd-manager< 1.8.12-r1
cluster-api-1.8-capd-manager-compat< 1.8.12-r1
cluster-api-1.8-clusterctl< 1.8.12-r1
cluster-api-1.8-clusterctl-compat< 1.8.12-r1
cluster-api-1.8-controller< 1.8.12-r1
cluster-api-1.8-controller-compat< 1.8.12-r1
cluster-api-1.8-kubeadm-bootstrap-controller< 1.8.12-r1
cluster-api-1.8-kubeadm-bootstrap-controller-compat< 1.8.12-r1
cluster-api-1.8-kubeadm-control-plane-controller< 1.8.12-r1
cluster-api-1.8-kubeadm-control-plane-controller-compat< 1.8.12-r1
cluster-api-1.9< 1.9.8-r1
cluster-api-1.9-capd-manager< 1.9.8-r1
cluster-api-1.9-capd-manager-compat< 1.9.8-r1
cluster-api-1.9-clusterctl< 1.9.8-r1
cluster-api-1.9-clusterctl-compat< 1.9.8-r1
cluster-api-1.9-controller< 1.9.8-r1
cluster-api-1.9-controller-compat< 1.9.8-r1
cluster-api-1.9-kubeadm-bootstrap-controller< 1.9.8-r1
cluster-api-1.9-kubeadm-bootstrap-controller-compat< 1.9.8-r1
cluster-api-1.9-kubeadm-control-plane-controller< 1.9.8-r1
cluster-api-1.9-kubeadm-control-plane-controller-compat< 1.9.8-r1
commercial-grafana-11.6< 11.6.14-r0
cosign< 2.5.0-r2
cosign-fips< 2.5.0-r4
crossplane-crank< 1.20.0-r1
crossplane-provider-aws< 1.22.0-r1
crossplane-provider-aws-cloudformation< 1.22.0-r1
crossplane-provider-aws-cloudformation-compat< 1.22.0-r1
crossplane-provider-aws-cloudfront< 1.22.0-r1
crossplane-provider-aws-cloudfront-compat< 1.22.0-r1
crossplane-provider-aws-cloudwatchlogs< 1.22.0-r1
crossplane-provider-aws-cloudwatchlogs-compat< 1.22.0-r1
crossplane-provider-aws-dynamodb< 1.22.0-r1
crossplane-provider-aws-dynamodb-compat< 1.22.0-r1
crossplane-provider-aws-ec2< 1.22.0-r1
crossplane-provider-aws-ec2-compat< 1.22.0-r1
crossplane-provider-aws-eks< 1.22.0-r1
crossplane-provider-aws-eks-compat< 1.22.0-r1
crossplane-provider-aws-elasticache< 1.22.0-r1
crossplane-provider-aws-elasticache-compat< 1.22.0-r1
crossplane-provider-aws-firehose< 1.22.0-r1
crossplane-provider-aws-firehose-compat< 1.22.0-r1
crossplane-provider-aws-iam< 1.22.0-r1
crossplane-provider-aws-iam-compat< 1.22.0-r1
crossplane-provider-aws-kinesis< 1.22.0-r1
crossplane-provider-aws-kinesis-compat< 1.22.0-r1
crossplane-provider-aws-kms< 1.22.0-r1
crossplane-provider-aws-kms-compat< 1.22.0-r1
crossplane-provider-aws-lambda< 1.22.0-r1
crossplane-provider-aws-lambda-compat< 1.22.0-r1
crossplane-provider-aws-memorydb< 1.22.0-r1
crossplane-provider-aws-memorydb-compat< 1.22.0-r1
crossplane-provider-aws-rds< 1.22.0-r1
crossplane-provider-aws-rds-compat< 1.22.0-r1
crossplane-provider-aws-route53< 1.22.0-r1
crossplane-provider-aws-route53-compat< 1.22.0-r1
crossplane-provider-aws-s3< 1.22.0-r1
crossplane-provider-aws-s3-compat< 1.22.0-r1
crossplane-provider-aws-sns< 1.22.0-r1
crossplane-provider-aws-sns-compat< 1.22.0-r1
crossplane-provider-aws-sqs< 1.22.0-r1
crossplane-provider-aws-sqs-compat< 1.22.0-r1
crossplane-provider-azure< 1.13.0-r1
crossplane-provider-azure-authorization< 1.13.0-r1
crossplane-provider-azure-authorization-compat< 1.13.0-r1
crossplane-provider-azure-managedidentity< 1.13.0-r1
crossplane-provider-azure-managedidentity-compat< 1.13.0-r1
crossplane-provider-azure-sql< 1.13.0-r1
crossplane-provider-azure-sql-compat< 1.13.0-r1
crossplane-provider-azure-storage< 1.13.0-r1
crossplane-provider-azure-storage-compat< 1.13.0-r1
crossplane-provider-family-aws< 1.22.0-r1
crossplane-provider-family-aws-compat< 1.22.0-r1
crossplane-provider-family-azure< 1.13.0-r1
crossplane-provider-family-azure-compat< 1.13.0-r1
crossplane-provider-family-gcp< 1.14.0-r1
crossplane-provider-family-gcp-compat< 1.14.0-r1
crossplane-provider-gcp< 1.14.0-r1
crossplane-provider-gcp-cloudplatform< 1.14.0-r1
crossplane-provider-gcp-cloudplatform-compat< 1.14.0-r1
crossplane-provider-gcp-compute< 1.14.0-r1
crossplane-provider-gcp-compute-compat< 1.14.0-r1
crossplane-provider-gcp-container< 1.14.0-r1
crossplane-provider-gcp-container-compat< 1.14.0-r1
crossplane-provider-gcp-dns< 1.14.0-r1
crossplane-provider-gcp-dns-compat< 1.14.0-r1
crossplane-provider-gcp-kms< 1.14.0-r1
crossplane-provider-gcp-kms-compat< 1.14.0-r1
crossplane-provider-gcp-pubsub< 1.14.0-r1
crossplane-provider-gcp-pubsub-compat< 1.14.0-r1
crossplane-provider-gcp-storage< 1.14.0-r1
crossplane-provider-gcp-storage-compat< 1.14.0-r1
crossplane-provider-keycloak< 1.7.0-r12
crossplane-provider-keycloak-fips< 1.7.0-r10
extism< 1.6.2-r5
falcoctl< 0.11.2-r1
falcoctl-fips< 0.11.2-r1
flux-2.5< 2.5.1-r9
flux-2.5-compat< 2.5.1-r9
flux-fips-2.4< 2.4.0-r13
flux-fips-2.4-compat< 2.4.0-r13
flux-fips-2.5< 2.5.1-r7
flux-fips-2.5-compat< 2.5.1-r7
gitness< 3.2.0-r1
gitsign< 0.13.0-r2
gitsign-config< 0.13.0-r2
gitsign-credential-cache< 0.13.0-r2
go-licenses< 1.6.0-r27
gomplate< 4.3.2-r3
gomplate-fips< 4.3.2-r3
goreleaser< 2.10.2-r1
gptscript< 0.9.5-r12
grafana-11.3< 11.3.7-r2
grafana-11.4< 11.4.5-r2
grafana-11.5< 11.5.5-r2
grafana-11.5-oci-compat< 11.5.5-r2
grafana-11.6< 11.6.2-r2
grafana-11.6-oci-compat< 11.6.2-r2
grafana-12.0< 12.0.1-r3
grafana-12.0-oci-compat< 12.0.1-r3
grafana-alloy< 1.9.1-r1
grafana-alloy-fips< 1.9.1-r1
grafana-fips-11.4< 11.4.5-r1
grafana-fips-11.4-oci-compat< 11.4.5-r1
grafana-fips-11.5< 11.5.5-r1
grafana-fips-11.5-oci-compat< 11.5.5-r1
grafana-fips-11.6< 11.6.2-r2
grafana-fips-11.6-oci-compat< 11.6.2-r2
grafana-fips-12.0< 12.0.1-r2
grafana-fips-12.0-oci-compat< 12.0.1-r2
guac< 0.14.0-r4
guaccsub< 0.14.0-r4
guacgql< 0.14.0-r4
guacingest< 0.14.0-r4

Show all 200

1 vendor · 200 products · Showing 200 of 595. Use Open JSON for the complete list.

References

14 links

access.redhat.com/security/cve/CVE-2025-8556VDB EntryX Refsource REDHATREPORTAdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=2371624Issue TrackingX Refsource REDHATREPORTWEB
github.com/cloudflare/circlREPORTPACKAGE
github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwmREPORTAdvisoryWEB
github.com/cloudflare/circl/tree/v1.6.1REPORTWEB
www.botanica.software/blog/cryptographic-issues-in-cloudflares-circl-fourq-implementationARTICLEWEB
news.ycombinator.com/item?id=45669593WEB
ubuntu.com/security/CVE-2025-8556REPORT
www.cve.org/CVERecord?id=CVE-2025-8556REPORT
security-tracker.debian.org/tracker/CVE-2025-8556Advisory

Show all 14 references