CVE-2026-3706

Description

A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch.

References

https://vuldb.com/?submit.765933

https://vuldb.com/?id.349652

https://vuldb.com/?ctiid.349652

https://github.com/str4d/ed25519-java/issues/82#issue-727629226

https://github.com/mkj/dropbear/pull/407

https://github.com/mkj/dropbear/issues/406#issue-3978907798

https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d

https://github.com/mkj/dropbear/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS