CVE-2026-1229: Incorrect calculation in CIRCL secp384r1 CombinedMult

Analyzed

AliasesUBUNTU-CVE-2026-1229CGA-22fh-5jxm-82j9CGA-23jv-3c5j-f57m+852 more

Published 24-02-2026Last modified 24-02-2026

Vulnerability summary

CVE-2026-1229 is a critical (CVSS 9.8) Incorrect Calculation vulnerability in cloudflare circl. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

0.43%

0%100%

Low · +0.04 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

24-02-2026
PublishedVulnerability first disclosed.
24-02-2026
Last modifiedVulnerability information updated.

Description

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

CVSS metrics

9 scores · 7 sources · 2 versions

v4.02.9v3.19.8

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 0.39% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-682Incorrect CalculationThe product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r43
actions-runner-controller< 0.13.1-r3
actions-runner-controller-fips< 0.13.1-r5
amazon-ssm-agent< 3.3.3270.0-r6
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r7

amazon-ssm-agent-fips< 3.3.3270.0-r7
apko< 1.1.11-r1
apko-fips< 1.1.11-r1
argo-cd-2.14-compat< 2.14.21-r9
argo-cd-3.0< 3.0.23-r3
argo-cd-3.0-compat< 3.0.23-r3
argo-cd-3.1< 3.1.12-r4
argo-cd-3.1-compat< 3.1.12-r4
argo-cd-3.2< 3.2.7-r1
argo-cd-3.2-compat< 3.2.7-r1
argo-cd-3.3< 3.3.2-r1
argo-cd-3.3-compat< 3.3.2-r1
argo-cd-fips-2.14< 2.14.21-r8
argo-cd-fips-2.14-compat< 2.14.21-r8
argo-cd-fips-3.0< 3.0.23-r4
argo-cd-fips-3.0-compat< 3.0.23-r4
argo-cd-fips-3.1< 3.1.12-r3
argo-cd-fips-3.1-compat< 3.1.12-r3
argo-cd-fips-3.2< 3.2.7-r1
argo-cd-fips-3.2-compat< 3.2.7-r1
argo-cd-fips-3.3< 3.3.2-r1
argo-cd-fips-3.3-compat< 3.3.2-r1
argo-events< 1.9.10-r4
argo-events-fips< 1.9.10-r3
argo-rollouts< 1.8.4-r2
argo-rollouts-fips< 1.8.4-r2
argo-workflow-executor-3.6< 3.6.19-r2
argo-workflow-executor-3.7< 3.7.10-r3
argo-workflow-executor-4.0< 4.0.1-r2
argo-workflow-executor-fips-3.6< 3.6.19-r2
argo-workflow-executor-fips-3.7< 3.7.10-r2
argo-workflow-executor-fips-4.0< 4.0.1-r2
argo-workflows-3.6< 3.6.19-r2
argo-workflows-3.7< 3.7.10-r3
argo-workflows-4.0< 4.0.1-r2
argo-workflows-fips-3.6< 3.6.19-r2
argo-workflows-fips-3.7< 3.7.10-r2
argo-workflows-fips-4.0< 4.0.1-r2
argocd-image-updater< 1.1.1-r1
argocd-image-updater-fips< 1.1.1-r1
atlantis< 0.40.0-r2
atlantis-fips< 0.40.0-r4
boring-registry< 0.16.6-r8
boring-registry-fips< 0.16.6-r7
buildkitd< 0.27.1-r4
buildkitd-fips< 0.27.1-r2
cerbos< 0.51.0-r4
cerbosctl< 0.51.0-r4
cerbosctl-fips< 0.51.0-r2
cert-manager-cmctl< 2.4.1-r1
cert-manager-cmctl-fips< 2.4.1-r1
cg< 0.2.212-r0
chainctl< 0.2.213-r0
cilium-cli< 0.19.2-r1
cloudbeat-8.17< 8.17.10-r8
cloudbeat-8.18All versions (No fix recorded)
cloudbeat-8.19< 8.19.12-r1
cloudbeat-9.0< 9.0.8-r8
cloudbeat-9.1< 9.1.10-r3
cloudbeat-9.2< 9.2.5-r4
cloudbeat-9.3< 9.3.1-r1
cloudbeat-fips-8.17< 8.17.10-r11
cloudbeat-fips-8.18All versions (No fix recorded)
cloudbeat-fips-8.19< 8.19.12-r0
cloudbeat-fips-9.0< 9.0.8-r8
cloudbeat-fips-9.1< 9.1.10-r3
cloudbeat-fips-9.2< 9.2.6-r0
cloudbeat-fips-9.3< 9.3.1-r3
cluster-api-1.10-clusterctl< 1.10.10-r3
cluster-api-1.11-clusterctl< 1.11.6-r1
cluster-api-1.12-clusterctl< 1.12.3-r1
cluster-api-1.7-clusterctl< 1.7.9-r12
cluster-api-1.8-clusterctl< 1.8.12-r11
cluster-api-1.9-clusterctl< 1.9.11-r8
cluster-api-fips-1.10-clusterctl< 1.10.10-r3
cluster-api-fips-1.11-clusterctl< 1.11.6-r1
cluster-api-fips-1.12-clusterctl< 1.12.3-r1
cluster-api-fips-1.7-clusterctl< 1.7.9-r6
cluster-api-fips-1.8-clusterctl< 1.8.12-r8
cluster-api-fips-1.9-clusterctl< 1.9.11-r6
commercial-grafana-11.6< 11.6.14-r0
commercial-grafana-12.1< 12.1.10-r0
commercial-grafana-12.2< 12.2.8-r0
commercial-grafana-12.3< 12.3.6-r0
commercial-grafana-12.4< 12.4.2-r0
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
crossplane-1.20-crank< 1.20.5-r3
crossplane-2.0-crank< 2.0.7-r3
crossplane-2.1-crank< 2.1.4-r4
crossplane-2.2-crank< 2.2.0-r1
crossplane-fips-1.20-crank< 1.20.5-r3
crossplane-fips-2.0-crank< 2.0.7-r3
crossplane-fips-2.1-crank< 2.1.4-r3
crossplane-fips-2.2-crank< 2.2.0-r2
crossplane-provider-aws-cloudformation< 2.4.0-r1
crossplane-provider-aws-cloudformation-fips< 2.4.0-r1
crossplane-provider-aws-cloudfront< 2.4.0-r1
crossplane-provider-aws-cloudfront-fips< 2.4.0-r1
crossplane-provider-aws-cloudwatchlogs< 2.4.0-r1
crossplane-provider-aws-cloudwatchlogs-fips< 2.4.0-r1
crossplane-provider-aws-cognitoidentity< 2.4.0-r1
crossplane-provider-aws-cognitoidentity-fips< 2.4.0-r1
crossplane-provider-aws-dynamodb< 2.4.0-r1
crossplane-provider-aws-dynamodb-fips< 2.4.0-r1
crossplane-provider-aws-ec2< 2.4.0-r1
crossplane-provider-aws-ec2-fips< 2.4.0-r1
crossplane-provider-aws-ecr< 2.4.0-r1
crossplane-provider-aws-ecr-fips< 2.4.0-r1
crossplane-provider-aws-efs< 2.4.0-r1
crossplane-provider-aws-efs-fips< 2.4.0-r1
crossplane-provider-aws-eks< 2.4.0-r1
crossplane-provider-aws-eks-fips< 2.4.0-r1
crossplane-provider-aws-elasticache< 2.4.0-r1
crossplane-provider-aws-elasticache-fips< 2.4.0-r1
crossplane-provider-aws-firehose< 2.4.0-r1
crossplane-provider-aws-firehose-fips< 2.4.0-r1
crossplane-provider-aws-iam< 2.4.0-r1
crossplane-provider-aws-iam-fips< 2.4.0-r1
crossplane-provider-aws-kinesis< 2.4.0-r1
crossplane-provider-aws-kinesis-fips< 2.4.0-r1
crossplane-provider-aws-kms< 2.4.0-r1
crossplane-provider-aws-kms-fips< 2.4.0-r1
crossplane-provider-aws-lambda< 2.4.0-r1
crossplane-provider-aws-lambda-fips< 2.4.0-r1
crossplane-provider-aws-memorydb< 2.4.0-r1
crossplane-provider-aws-memorydb-fips< 2.4.0-r1
crossplane-provider-aws-rds< 2.4.0-r1
crossplane-provider-aws-rds-fips< 2.4.0-r1
crossplane-provider-aws-route53< 2.4.0-r1
crossplane-provider-aws-route53-fips< 2.4.0-r1
crossplane-provider-aws-s3< 2.4.0-r1
crossplane-provider-aws-s3-fips< 2.4.0-r1
crossplane-provider-aws-sns< 2.4.0-r1
crossplane-provider-aws-sns-fips< 2.4.0-r1
crossplane-provider-aws-sqs< 2.4.0-r1
crossplane-provider-aws-sqs-fips< 2.4.0-r1
crossplane-provider-azure-authorization< 2.4.0-r1
crossplane-provider-azure-managedidentity< 2.4.0-r1
crossplane-provider-azure-sql< 2.4.0-r1
crossplane-provider-azure-storage< 2.4.0-r1
crossplane-provider-family-aws< 2.4.0-r1
crossplane-provider-family-aws-fips< 2.4.0-r1
crossplane-provider-family-azure< 2.4.0-r1
crossplane-provider-keycloak< 2.14.0-r2
crossplane-provider-keycloak-fips< 2.14.0-r4
dagger< 0.19.11-r2
databricks-cli< 0.290.1-r1
databricks-cli-fips< 0.290.1-r1
datadog-agent-7.71All versions (No fix recorded)
datadog-agent-7.72All versions (No fix recorded)
datadog-agent-7.73All versions (No fix recorded)
datadog-agent-7.74All versions (No fix recorded)
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.76< 7.76.1-r0
datadog-agent-fips-7.71All versions (No fix recorded)
datadog-agent-fips-7.72All versions (No fix recorded)
datadog-agent-fips-7.73All versions (No fix recorded)
datadog-agent-fips-7.74All versions (No fix recorded)
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.76< 7.76.1-r1 | < 7.76.1-r0
docker-cli-buildx< 0.31.1-r3
docker-cli-buildx-fips< 0.31.1-r4
dockerd-29< 29.2.1-r2
dockerd-fips-29< 29.1.3-r5
external-secrets-operator-0.19All versions (No fix recorded)
external-secrets-operator-0.20All versions (No fix recorded)
external-secrets-operator-1.0All versions (No fix recorded)
external-secrets-operator-1.1All versions (No fix recorded)
external-secrets-operator-1.2All versions (No fix recorded)
external-secrets-operator-1.3All versions (No fix recorded)
external-secrets-operator-2.0< 2.0.1-r1
external-secrets-operator-fips-0.19All versions (No fix recorded)
external-secrets-operator-fips-0.20All versions (No fix recorded)
external-secrets-operator-fips-1.0All versions (No fix recorded)
external-secrets-operator-fips-1.1All versions (No fix recorded)
external-secrets-operator-fips-1.2All versions (No fix recorded)
external-secrets-operator-fips-1.3All versions (No fix recorded)
external-secrets-operator-fips-2.0< 2.0.1-r1
extism< 1.6.3-r8
flux-2.5< 2.5.1-r21
flux-2.6< 2.6.4-r13
flux-2.7< 2.7.5-r7
flux-2.8< 2.8.1-r1
flux-fips-2.4All versions (No fix recorded)
flux-fips-2.5< 2.5.1-r19
flux-fips-2.6< 2.6.4-r13
flux-fips-2.7< 2.7.5-r7
flux-fips-2.8< 2.8.1-r1
flux-helm-controller< 1.5.0-r1
flux-helm-controller-fips< 1.5.1-r2

Show all 199

Alpine1 product

rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 626

References

11 links

github.com/cloudflare/circlREPORTPACKAGEProduct
ubuntu.com/security/CVE-2026-1229REPORT
www.cve.org/CVERecord?id=CVE-2026-1229REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1229.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-1229Advisory
github.com/cloudflare/circl/security/advisories/GHSA-q9hv-hpm4-hj6xWEBAdvisory
github.com/cloudflare/circl/pull/583WEBFIX
github.com/cloudflare/circl/releases/tag/v1.6.3WEB
www.suse.com/security/cve/CVE-2026-1229WEB
bugzilla.suse.com/1265533REPORT

Show all 11 references

security.alpinelinux.org/vuln/CVE-2026-1229Advisory