CVE-2026-1229
NoneCVSS
—
EPSS
0.4%
Published
Feb 24, 2026
CISA due date
—
The record
The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/cloudflare/circl | 0 | 1.6.3 |
| Chainguard | aactl | 0 | 0.4.12-r43 |
| Chainguard | actions-runner-controller | 0 | 0.13.1-r3 |
| Chainguard | actions-runner-controller-fips | 0 | 0.13.1-r5 |
| Chainguard | amazon-ssm-agent | 0 | 3.3.3270.0-r6 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r7 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r7 |
| Chainguard | apko | 0 | 1.1.11-r1 |
| Chainguard | apko-fips | 0 | 1.1.11-r1 |
| Chainguard | argo-cd-2.14-compat | 0 | 2.14.21-r9 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.23-r3 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.23-r3 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.12-r4 |
| Chainguard | argo-cd-3.1-compat | 0 | 3.1.12-r4 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.7-r1 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.7-r1 |
| Chainguard | argo-cd-3.3 | 0 | 3.3.2-r1 |
| Chainguard | argo-cd-3.3-compat | 0 | 3.3.2-r1 |
| Chainguard | argo-cd-fips-2.14 | 0 | 2.14.21-r8 |
| Chainguard | argo-cd-fips-2.14-compat | 0 | 2.14.21-r8 |
| Chainguard | argo-cd-fips-3.0 | 0 | 3.0.23-r4 |
| Chainguard | argo-cd-fips-3.0-compat | 0 | 3.0.23-r4 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.12-r3 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.12-r3 |
| Chainguard | argo-cd-fips-3.2 | 0 | 3.2.7-r1 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.7-r1 |
| Chainguard | argo-cd-fips-3.3 | 0 | 3.3.2-r1 |
| Chainguard | argo-cd-fips-3.3-compat | 0 | 3.3.2-r1 |
| Chainguard | argo-events | 0 | 1.9.10-r4 |
| Chainguard | argo-events-fips | 0 | 1.9.10-r3 |
| Chainguard | argo-rollouts | 0 | 1.8.4-r2 |
| Chainguard | argo-rollouts-fips | 0 | 1.8.4-r2 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.19-r2 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.10-r3 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.1-r2 |
| Chainguard | argo-workflow-executor-fips-3.6 | 0 | 3.6.19-r2 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 3.7.10-r2 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.1-r2 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.19-r2 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.10-r3 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.1-r2 |
| Chainguard | argo-workflows-fips-3.6 | 0 | 3.6.19-r2 |
| Chainguard | argo-workflows-fips-3.7 | 0 | 3.7.10-r2 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.1-r2 |
| Chainguard | argocd-image-updater | 0 | 1.1.1-r1 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.1-r1 |
| Chainguard | atlantis | 0 | 0.40.0-r2 |
| Chainguard | atlantis-fips | 0 | 0.40.0-r4 |
| Chainguard | boring-registry | 0 | 0.16.6-r8 |
| Chainguard | boring-registry-fips | 0 | 0.16.6-r7 |
| Chainguard | buildkitd | 0 | 0.27.1-r4 |
| Chainguard | buildkitd-fips | 0 | 0.27.1-r2 |
| Chainguard | cerbos | 0 | 0.51.0-r4 |
| Chainguard | cerbosctl | 0 | 0.51.0-r4 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r2 |
| Chainguard | cert-manager-cmctl | 0 | 2.4.1-r1 |
| Chainguard | cert-manager-cmctl-fips | 0 | 2.4.1-r1 |
| Chainguard | cg | 0 | 0.2.212-r0 |
| Chainguard | chainctl | 0 | 0.2.213-r0 |
| Chainguard | cilium-cli | 0 | 0.19.2-r1 |
| Chainguard | cloudbeat-8.17 | 0 | 8.17.10-r8 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.12-r1 |
| Chainguard | cloudbeat-9.0 | 0 | 9.0.8-r8 |
| Chainguard | cloudbeat-9.1 | 0 | 9.1.10-r3 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.5-r4 |
| Chainguard | cloudbeat-9.3 | 0 | 9.3.1-r1 |
| Chainguard | cloudbeat-fips-8.17 | 0 | 8.17.10-r11 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.12-r0 |
| Chainguard | cloudbeat-fips-9.0 | 0 | 9.0.8-r8 |
| Chainguard | cloudbeat-fips-9.1 | 0 | 9.1.10-r3 |
| Chainguard | cloudbeat-fips-9.2 | 0 | 9.2.6-r0 |
| Chainguard | cloudbeat-fips-9.3 | 0 | 9.3.1-r3 |
| Chainguard | cluster-api-1.10-clusterctl | 0 | 1.10.10-r3 |
| Chainguard | cluster-api-1.11-clusterctl | 0 | 1.11.6-r1 |
| Chainguard | cluster-api-1.12-clusterctl | 0 | 1.12.3-r1 |
| Chainguard | cluster-api-1.7-clusterctl | 0 | 1.7.9-r12 |
| Chainguard | cluster-api-1.8-clusterctl | 0 | 1.8.12-r11 |
| Chainguard | cluster-api-1.9-clusterctl | 0 | 1.9.11-r8 |
| Chainguard | cluster-api-fips-1.10-clusterctl | 0 | 1.10.10-r3 |
| Chainguard | cluster-api-fips-1.11-clusterctl | 0 | 1.11.6-r1 |
| Chainguard | cluster-api-fips-1.12-clusterctl | 0 | 1.12.3-r1 |
| Chainguard | cluster-api-fips-1.7-clusterctl | 0 | 1.7.9-r6 |
| Chainguard | cluster-api-fips-1.8-clusterctl | 0 | 1.8.12-r8 |
| Chainguard | cluster-api-fips-1.9-clusterctl | 0 | 1.9.11-r6 |
| Chainguard | commercial-grafana-11.6 | 0 | 11.6.14-r0 |
| Chainguard | commercial-grafana-12.1 | 0 | 12.1.10-r0 |
| Chainguard | commercial-grafana-12.2 | 0 | 12.2.8-r0 |
| Chainguard | commercial-grafana-12.3 | 0 | 12.3.6-r0 |
| Chainguard | commercial-grafana-12.4 | 0 | 12.4.2-r0 |
| Chainguard | crossplane-1.20-crank | 0 | 1.20.5-r3 |
| Chainguard | crossplane-2.0-crank | 0 | 2.0.7-r3 |
| Chainguard | crossplane-2.1-crank | 0 | 2.1.4-r4 |
| Chainguard | crossplane-2.2-crank | 0 | 2.2.0-r1 |
| Chainguard | crossplane-fips-1.20-crank | 0 | 1.20.5-r3 |
| Chainguard | crossplane-fips-2.0-crank | 0 | 2.0.7-r3 |
| Chainguard | crossplane-fips-2.1-crank | 0 | 2.1.4-r3 |
| Chainguard | crossplane-fips-2.2-crank | 0 | 2.2.0-r2 |
| Chainguard | crossplane-provider-aws-cloudformation | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cloudformation-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cloudfront | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cloudfront-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cloudwatchlogs | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cloudwatchlogs-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cognitoidentity | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-cognitoidentity-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-dynamodb | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-dynamodb-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-ec2 | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-ec2-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-ecr | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-ecr-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-efs | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-efs-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-eks | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-eks-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-elasticache | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-elasticache-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-firehose | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-firehose-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-iam | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-iam-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-kinesis | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-kinesis-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-kms | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-kms-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-lambda | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-lambda-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-memorydb | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-memorydb-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-rds | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-rds-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-route53 | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-route53-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-s3 | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-s3-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-sns | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-sns-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-sqs | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-aws-sqs-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-azure-authorization | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-azure-managedidentity | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-azure-sql | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-azure-storage | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-family-aws | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-family-aws-fips | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-family-azure | 0 | 2.4.0-r1 |
| Chainguard | crossplane-provider-keycloak | 0 | 2.14.0-r2 |
| Chainguard | crossplane-provider-keycloak-fips | 0 | 2.14.0-r4 |
| Chainguard | dagger | 0 | 0.19.11-r2 |
| Chainguard | databricks-cli | 0 | 0.290.1-r1 |
| Chainguard | databricks-cli-fips | 0 | 0.290.1-r1 |
| Chainguard | datadog-agent-7.76 | 0 | 7.76.1-r0 |
| Chainguard | datadog-agent-fips-7.76 | 0 | 7.76.1-r1 |
| Chainguard | docker-cli-buildx | 0 | 0.31.1-r3 |
| Chainguard | docker-cli-buildx-fips | 0 | 0.31.1-r4 |
| Chainguard | dockerd-29 | 0 | 29.2.1-r2 |
| Chainguard | dockerd-fips-29 | 0 | 29.1.3-r5 |
| Chainguard | external-secrets-operator-2.0 | 0 | 2.0.1-r1 |
| Chainguard | external-secrets-operator-fips-2.0 | 0 | 2.0.1-r1 |
| Chainguard | extism | 0 | 1.6.3-r8 |
| Chainguard | flux-2.5 | 0 | 2.5.1-r21 |
| Chainguard | flux-2.6 | 0 | 2.6.4-r13 |
| Chainguard | flux-2.7 | 0 | 2.7.5-r7 |
| Chainguard | flux-2.8 | 0 | 2.8.1-r1 |
| Chainguard | flux-fips-2.5 | 0 | 2.5.1-r19 |
| Chainguard | flux-fips-2.6 | 0 | 2.6.4-r13 |
| Chainguard | flux-fips-2.7 | 0 | 2.7.5-r7 |
| Chainguard | flux-fips-2.8 | 0 | 2.8.1-r1 |
| Chainguard | flux-helm-controller | 0 | 1.5.0-r1 |
| Chainguard | flux-helm-controller-fips | 0 | 1.5.1-r2 |
| Chainguard | flux-image-automation-controller | 0 | 1.1.0-r1 |
| Chainguard | flux-image-automation-controller-fips | 0 | 1.1.0-r1 |
| Chainguard | flux-kustomize-controller | 0 | 1.8.0-r2 |
| Chainguard | flux-kustomize-controller-fips | 0 | 1.8.0-r2 |
| Chainguard | flux-notification-controller | 0 | 1.8.0-r1 |
| Chainguard | flux-notification-controller-fips | 0 | 1.8.0-r1 |
| Chainguard | flux-source-controller | 0 | 1.8.0-r1 |
| Chainguard | flux-source-controller-fips | 0 | 1.8.0-r1 |
| Chainguard | gitaly-18.7 | 0 | 18.7.5-r1 |
| Chainguard | gitaly-18.8 | 0 | 18.8.5-r1 |
| Chainguard | gitaly-18.9 | 0 | 18.9.1-r1 |
| Chainguard | gitaly-fips-18.7 | 0 | 18.7.5-r1 |
| Chainguard | gitaly-fips-18.8 | 0 | 18.8.5-r1 |
| Chainguard | gitaly-fips-18.9 | 0 | 18.9.1-r1 |
| Chainguard | gitea | 0 | 1.25.4-r4 |
| Chainguard | gitea-fips | 0 | 1.25.4-r4 |
| Chainguard | gitlab-operator | 0 | 2.9.1-r1 |
| Chainguard | gitlab-operator-fips | 0 | 2.9.1-r1 |
| Chainguard | gitlab-rails-ce-18.7 | 0 | 18.7.6-r1 |
| Chainguard | gitlab-rails-ce-18.8 | 0 | 18.8.6-r1 |
| Chainguard | gitlab-rails-ce-18.9 | 0 | 18.9.2-r1 |
| Chainguard | gitlab-rails-ce-fips-18.8 | 0 | 18.8.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.9 | 0 | 18.9.2-r0 |
| Chainguard | gitlab-runner-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-18.9 | 0 | 18.9.0-r1 |
| Chainguard | gitlab-runner-fips-18.7 | 0 | 18.7.2-r5 |
| Chainguard | gitlab-runner-fips-18.8 | 0 | 18.8.0-r3 |
| Chainguard | gitlab-runner-fips-18.9 | 0 | 18.9.0-r1 |
| Chainguard | gitlab-runner-helper-18.7 | 0 | 18.7.2-r4 |
Related vulnerabilities
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects aactl
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects aactl
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects aactl
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects aactl