CVE-2026-26958
NoneCVSS
—
EPSS
0.5%
Published
Feb 19, 2026
CISA due date
—
The record
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | filippo.io/edwards25519 | 0 | 1.1.1 |
| Chainguard | aactl | 0 | 0.4.12-r43 |
| Chainguard | age | 0 | 1.3.1-r3 |
| Chainguard | age-fips | 0 | 1.3.1-r3 |
| Chainguard | agentbeat | 0 | 9.2.4-r3 |
| Chainguard | agentbeat-fips | 0 | 9.2.4-r3 |
| Chainguard | amass | 0 | 5.0.1-r7 |
| Chainguard | amazon-ssm-agent | 0 | 0 |
| Chainguard | amazon-ssm-agent-ecs-exec | 0 | 0 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 0 |
| Chainguard | amazon-ssm-agent-fips | 0 | 0 |
| Chainguard | apko | 0 | 1.1.9-r1 |
| Chainguard | apko-fips | 0 | 1.1.9-r1 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.10-r1 |
| Chainguard | argo-workflow-controller-4.0 | 0 | 4.0.1-r1 |
| Chainguard | argo-workflow-controller-fips-4.0 | 0 | 4.0.1-r1 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.10-r1 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.1-r1 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 3.7.10-r1 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.1-r1 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.1-r1 |
| Chainguard | argo-workflows-fips-3.7 | 0 | 3.7.10-r1 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.1-r1 |
| Chainguard | azure-service-operator | 0 | 0 |
| Chainguard | azure-service-operator-fips | 0 | 0 |
| Chainguard | caddy | 0 | 2.10.2-r10 |
| Chainguard | caddy-fips | 0 | 2.10.2-r11 |
| Chainguard | cerbos | 0 | 0.51.0-r3 |
| Chainguard | cerbos-fips | 0 | 0 |
| Chainguard | certificate-transparency-fips-trillian-ctserver | 0 | 1.3.2-r9 |
| Chainguard | certificate-transparency-trillian-ctserver | 0 | 1.3.2-r9 |
| Chainguard | cg | 0 | 0.2.209-r0 |
| Chainguard | chezmoi | 0 | 2.69.4-r1 |
| Chainguard | croc | 0 | 10.3.1-r4 |
| Chainguard | crossplane-provider-sql | 0 | 0.14.0-r1 |
| Chainguard | crossplane-provider-sql-fips | 0 | 0.14.0-r1 |
| Chainguard | dagdotdev | 0 | 0 |
| Chainguard | dapr-daprd-1.17 | 0 | 0 |
| Chainguard | dapr-daprd-fips-1.17 | 0 | 0 |
| Chainguard | db-operator | 0 | 2.16.0-r6 |
| Chainguard | db-operator-fips | 0 | 0 |
| Chainguard | dbmate | 0 | 2.31.0-r1 |
| Chainguard | dex | 0 | 2.44.0-r10 |
| Chainguard | dex-fips | 0 | 2.44.0-r10 |
| Chainguard | dgraph | 0 | 25.2.0-r3 |
| Chainguard | elastic-agent-8.19 | 0 | 8.19.11-r2 |
| Chainguard | elastic-agent-9.0 | 0 | 9.0.8-r6 |
| Chainguard | elastic-agent-9.1 | 0 | 9.1.10-r3 |
| Chainguard | elastic-agent-9.2 | 0 | 9.2.5-r2 |
| Chainguard | elastic-agent-fips-8.19 | 0 | 8.19.11-r2 |
| Chainguard | elastic-agent-fips-9.0 | 0 | 9.0.8-r7 |
| Chainguard | elastic-agent-fips-9.1 | 0 | 9.1.10-r3 |
| Chainguard | elastic-agent-fips-9.2 | 0 | 9.2.5-r3 |
| Chainguard | elastic-otel-collector-9.3 | 0 | 9.3.0-r2 |
| Chainguard | elastic-otel-collector-fips-9.3 | 0 | 9.3.0-r2 |
| Chainguard | envoy-gateway-egctl | 0 | 1.7.0-r1 |
| Chainguard | envoy-gateway-fips-egctl | 0 | 1.7.0-r1 |
| Chainguard | flux-kustomize-controller | 0 | 1.8.0-r1 |
| Chainguard | flux-kustomize-controller-fips | 0 | 1.8.0-r1 |
| Chainguard | fulcio | 0 | 1.8.5-r4 |
| Chainguard | fulcio-fips | 0 | 1.8.5-r5 |
| Chainguard | gitea | 0 | 1.25.4-r3 |
| Chainguard | gitea-fips | 0 | 1.25.4-r3 |
| Chainguard | gitsign | 0 | 0.14.0-r4 |
| Chainguard | google-cloud-otel-ops-collector | 0 | 0 |
| Chainguard | goose | 0 | 0 |
| Chainguard | goose-fips | 0 | 3.26.0-r5 |
| Chainguard | grafana-alloy | 0 | 1.13.1-r1 |
| Chainguard | grafana-alloy-fips | 0 | 1.13.1-r1 |
| Chainguard | hydra | 0 | 25.4.0-r5 |
| Chainguard | hydra-fips | 0 | 25.4.0-r6 |
| Chainguard | jitsucom-bulker-bulker | 0 | 2.11.913-r5 |
| Chainguard | jitsucom-bulker-sidecar | 0 | 2.11.913-r5 |
| Chainguard | juicefs-1.3 | 0 | 1.3.1-r6 |
| Chainguard | k3s | 0 | 1.35.1.1-r1 |
| Chainguard | k3s-1.31 | 0 | 1.31.6.1-r14 |
| Chainguard | k3s-1.32 | 0 | 1.32.13.1-r2 |
| Chainguard | k3s-1.33 | 0 | 1.33.10.1-r1 |
| Chainguard | k3s-static | 0 | 1.35.1.1-r1 |
| Chainguard | k3s-static-1.31 | 0 | 1.31.6.1-r14 |
| Chainguard | k3s-static-1.32 | 0 | 1.32.13.1-r2 |
| Chainguard | k3s-static-1.33 | 0 | 1.33.10.1-r1 |
| Chainguard | keda-2.18 | 0 | 2.18.3-r4 |
| Chainguard | keda-2.18-metrics-apiserver | 0 | 2.18.3-r4 |
| Chainguard | keda-2.19 | 0 | 0 |
| Chainguard | keda-2.19-metrics-apiserver | 0 | 0 |
| Chainguard | keda-fips-2.18 | 0 | 0 |
| Chainguard | keda-fips-2.18-metrics-apiserver | 0 | 0 |
| Chainguard | keda-fips-2.19 | 0 | 2.19.0-r1 |
| Chainguard | keda-fips-2.19-metrics-apiserver | 0 | 2.19.0-r1 |
| Chainguard | kine | 0 | 0.14.11-r2 |
| Chainguard | kots | 0 | 1.129.3-r3 |
| Chainguard | ksops | 0 | 4.4.0-r6 |
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.15.0-r13 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.15.0-r13 |
| Chainguard | kyverno-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-1.15 | 0 | 1.15.3-r3 |
| Chainguard | kyverno-background-controller-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-background-controller-1.15 | 0 | 1.15.3-r3 |
| Chainguard | kyverno-background-controller-fips-1.15 | 0 | 1.15.3-r5 |
| Chainguard | kyverno-cleanup-controller-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-cleanup-controller-1.15 | 0 | 1.15.3-r3 |
| Chainguard | kyverno-cleanup-controller-fips-1.15 | 0 | 1.15.3-r5 |
| Chainguard | kyverno-cli-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-cli-1.15 | 0 | 1.15.3-r3 |
| Chainguard | kyverno-cli-fips-1.15 | 0 | 1.15.3-r5 |
| Chainguard | kyverno-fips-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-fips-1.15 | 0 | 1.15.3-r5 |
| Chainguard | kyverno-init-container-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-init-container-1.15 | 0 | 1.15.3-r3 |
| Chainguard | kyverno-init-container-fips-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-init-container-fips-1.15 | 0 | 1.15.3-r5 |
| Chainguard | kyverno-policy-reporter | 0 | 3.7.2-r1 |
| Chainguard | kyverno-policy-reporter-fips | 0 | 3.7.2-r1 |
| Chainguard | kyverno-reports-controller-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-reports-controller-1.15 | 0 | 1.15.3-r3 |
| Chainguard | kyverno-reports-controller-fips-1.14 | 0 | 1.14.5-r8 |
| Chainguard | kyverno-reports-controller-fips-1.15 | 0 | 1.15.3-r5 |
| Chainguard | loki-3.6 | 0 | 3.6.6-r1 |
| Chainguard | loki-3.6-logcli | 0 | 3.6.6-r1 |
| Chainguard | loki-fips-3.6 | 0 | 3.6.6-r1 |
| Chainguard | loki-fips-3.6-logcli | 0 | 3.6.6-r1 |
| Chainguard | mariadb-operator | 0 | 25.10.4-r5 |
| Chainguard | mariadb-operator-fips | 0 | 25.10.4-r4 |
| Chainguard | mattermost-10.11 | 0 | 10.11.11-r1 |
| Chainguard | mattermost-11.2 | 0 | 0 |
| Chainguard | mattermost-11.4 | 0 | 0 |
| Chainguard | mattermost-fips-10.11 | 0 | 10.11.11-r1 |
| Chainguard | mattermost-fips-11.2 | 0 | 11.2.3-r1 |
| Chainguard | mattermost-fips-11.4 | 0 | 11.4.0-r2 |
| Chainguard | metricbeat-9.2 | 0 | 9.2.5-r3 |
| Chainguard | metricbeat-9.3 | 0 | 9.3.0-r1 |
| Chainguard | metricbeat-fips-9.2 | 0 | 9.2.5-r4 |
| Chainguard | metricbeat-fips-9.3 | 0 | 9.3.0-r2 |
| Chainguard | minio | 0 | 0.20251015.172955-r5 |
| Chainguard | minio-fips | 0 | 0 |
| Chainguard | no-docs-check | 0 | 0 |
| Chainguard | nri-mysql | 0 | 1.19.0-r1 |
| Chainguard | nri-mysql-fips | 0 | 1.19.0-r1 |
| Chainguard | nuclei | 0 | 3.7.0-r3 |
| Chainguard | openbao | 0 | 2.5.0-r2 |
| Chainguard | openbao-fips | 0 | 0 |
| Chainguard | openfga | 0 | 1.11.5-r1 |
| Chainguard | openfga-fips | 0 | 1.11.5-r1 |
| Chainguard | opentelemetry-collector-contrib | 0 | 0 |
| Chainguard | opentelemetry-collector-contrib-fips | 0 | 0 |
| Chainguard | ory-kratos | 0 | 25.4.0-r2 |
| Chainguard | ory-kratos-fips | 0 | 25.4.0-r2 |
| Chainguard | peerdb-flow | 0 | 0 |
| Chainguard | percona-xtradb-cluster-operator | 0 | 1.19.0-r4 |
| Chainguard | percona-xtradb-cluster-operator-fips | 0 | 1.19.0-r3 |
| Chainguard | percona-xtradb-cluster-operator-fips-pitr | 0 | 1.19.0-r3 |
| Chainguard | percona-xtradb-cluster-operator-pitr | 0 | 1.19.0-r4 |
| Chainguard | prometheus-mysqld-exporter | 0 | 0.18.0-r6 |
| Chainguard | prometheus-mysqld-exporter-fips | 0 | 0.18.0-r6 |
| Chainguard | ratify | 0 | 1.4.0-r11 |
| Chainguard | ratify-fips | 0 | 1.4.0-r14 |
| Chainguard | rekor-backfill-index | 0 | 1.5.0-r3 |
| Chainguard | rekor-cli | 0 | 1.5.0-r3 |
| Chainguard | rekor-fips-backfill-index | 0 | 1.5.0-r2 |
| Chainguard | rekor-fips-cli | 0 | 1.5.0-r2 |
| Chainguard | rekor-fips-server | 0 | 1.5.0-r2 |
| Chainguard | rekor-server | 0 | 1.5.0-r3 |
| Chainguard | reports-server | 0 | 0.1.6-r2 |
| Chainguard | rke2-runtime-1.31 | 0 | 1.31.14.2.1-r8 |
| Chainguard | rke2-runtime-1.32 | 0 | 0 |
| Chainguard | rke2-runtime-1.33 | 0 | 0 |
| Chainguard | rke2-runtime-1.34 | 0 | 0 |
| Chainguard | rke2-runtime-1.35 | 0 | 0 |
| Chainguard | seaweedfs | 0 | 4.13-r1 |
| Chainguard | seaweedfs-fips | 0 | 4.13-r1 |
| Chainguard | sftpgo | 0 | 2.7.0-r5 |
| Chainguard | sftpgo-plugin-eventsearch | 0 | 0 |
| Chainguard | sftpgo-plugin-eventstore | 0 | 1.0.22-r5 |
| Chainguard | sigstore-scaffolding-fips-fulcio-createcerts | 0 | 0 |
| Chainguard | sigstore-scaffolding-fips-rekor-createsecret | 0 | 0 |
| Chainguard | sigstore-scaffolding-fips-trillian-createdb | 0 | 0 |
| Chainguard | sigstore-scaffolding-fips-tsa-createcertchain | 0 | 0 |
| Chainguard | sigstore-scaffolding-fulcio-createcerts | 0 | 0 |
| Chainguard | sigstore-scaffolding-rekor-createsecret | 0 | 0 |
| Chainguard | sigstore-scaffolding-trillian-createdb | 0 | 0 |
| Chainguard | sigstore-scaffolding-tsa-createcertchain | 0 | 0 |
| Chainguard | slsa-verifier | 0 | 0 |
| Chainguard | sops | 0 | 3.11.0-r7 |
| Chainguard | sops-fips | 0 | 3.11.0-r8 |
| Chainguard | spicedb | 0 | 1.49.1-r1 |
| Chainguard | spicedb-fips | 0 | 1.49.1-r1 |
| Chainguard | spire-server | 0 | 1.14.1-r5 |
| Chainguard | spire-server-fips | 0 | 1.14.1-r6 |
| Chainguard | splunk-otel-collector | 0 | 0.145.1-r1 |
| Chainguard | splunk-otel-collector-fips | 0 | 0 |
| Chainguard | sql_exporter | 0 | 0.19.1-r1 |
| Chainguard | sql_exporter-fips | 0 | 0.19.1-r1 |
| Chainguard | step | 0 | 0.29.0-r4 |
| Chainguard | step-ca | 0 | 0.29.0-r3 |
| Chainguard | step-ca-fips | 0 | 0.29.0-r5 |
| Chainguard | step-fips | 0 | 0.29.0-r5 |
| Chainguard | step-issuer | 0 | 0.9.11-r4 |
| Chainguard | step-issuer-fips | 0 | 0 |
| Chainguard | step-kms-plugin | 0 | 0.16.0-r5 |
Related vulnerabilities
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects aactl
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects aactl
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects aactl
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects aactl