Description
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | circl | < 1.6.1 | 1.6.1 |
| Red Hat | Builds for Red Hat OpenShift | — | — |
| Red Hat | Custom Metric Autoscaler operator for Red Hat Openshift | — | — |
| Red Hat | Multicluster Global Hub | — | — |
| Red Hat | OpenShift Pipelines | — | — |
| Red Hat | OpenShift Serverless | — | — |
| Red Hat | OpenShift Service Mesh 3 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Security 4 | — | — |
| Red Hat | Red Hat Ceph Storage 5 | — | — |
| Red Hat | Red Hat Ceph Storage 6 | — | — |
| Red Hat | Red Hat Ceph Storage 8 | — | — |
| Red Hat | Red Hat Developer Hub 1 | — | — |
| Red Hat | Red Hat Edge Manager preview | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Dev Workspaces Operator | — | — |
| Red Hat | Red Hat OpenShift for Windows Containers | — | — |
| Red Hat | Red Hat OpenShift GitOps | — | — |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — |
| Red Hat | Red Hat Trusted Application Pipeline | — | — |
| Red Hat | Red Hat Trusted Artifact Signer | — | — |
| Red Hat | Red Hat Trusted Profile Analyzer | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-cloudflare-circl | 1.6.1-1 | — |
| Debian 13 | golang-github-cloudflare-circl | 1.6.1-1 | — |
| Debian 12 | golang-github-cloudflare-circl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | golang-github-cloudflare-circl | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-cloudflare-circl | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apptainer | 1.4.5-150600.4.12.1 | SUSE-SU-2026:0439-1 |
| SLES 15 SP7 | squashfuse | 0.5.0-150600.3.2.1 | SUSE-SU-2026:0439-1 |
| SLES 15 SP6 | apptainer | 1.4.5-150600.4.12.1 | SUSE-SU-2026:0439-1 |
| SLES 15 SP6 | squashfuse | 0.5.0-150600.3.2.1 | SUSE-SU-2026:0439-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apptainer | 1.4.5-1.1 | openSUSE-SU-2026:10013-1 |
| openSUSE Leap 15.6 | apptainer | 1.4.5-150600.4.12.1 | SUSE-SU-2026:0439-1 |
| openSUSE Leap 15.6 | squashfuse | 0.5.0-150600.3.2.1 | SUSE-SU-2026:0439-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-ssm-agent | 3.3.3572.0-1.amzn2023 | ALAS2023-2025-1359 |
| Amazon Linux 2 | amazon-ssm-agent | 3.3.3572.0-1.amzn2 | ALAS2-2025-3121 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r32 | — |
| Wolfi rolling | actions-runner-controller +1 | 0.11.0-r3 | — |
| Wolfi rolling | argo-events | 1.9.6-r3 | — |
| Wolfi rolling | argo-rollouts +1 | 1.8.3-r1 | — |
| Wolfi rolling | argo-workflows | 3.6.10-r1 | — |
| Wolfi rolling | argocd-image-updater +1 | 0.16.0-r4 | — |
| Wolfi rolling | atlantis | 0.34.0-r3 | — |
| Wolfi rolling | buildkitd | 0.26.0-r1 | — |
| Wolfi rolling | caddy +2 | 2.10.0-r1 | — |
| Wolfi rolling | cosign | 2.5.0-r2 | — |
| Wolfi rolling | crossplane-crank | 1.20.0-r1 | — |
| Wolfi rolling | crossplane-provider-aws +38 | 1.22.0-r1 | — |
| Wolfi rolling | crossplane-provider-azure-sql +9 | 1.13.0-r1 | — |
| Wolfi rolling | crossplane-provider-keycloak | 1.7.0-r12 | — |
| Wolfi rolling | extism | 1.6.2-r5 | — |
| Wolfi rolling | falcoctl | 0.11.2-r1 | — |
| Wolfi rolling | gitness | 3.2.0-r1 | — |
| Wolfi rolling | gitsign +2 | 0.13.0-r2 | — |
| Wolfi rolling | go-licenses | 1.6.0-r27 | — |
| Wolfi rolling | gomplate | 4.3.2-r3 | — |
| Wolfi rolling | goreleaser | 2.10.2-r1 | — |
| Wolfi rolling | gptscript | 0.9.5-r12 | — |
| Wolfi rolling | guac +4 | 0.14.0-r4 | — |
| Wolfi rolling | hydra | 2.3.0-r9 | — |
| Wolfi rolling | kots +2 | 1.124.17-r1 | — |
| Wolfi rolling | ksops +1 | 4.3.3-r10 | — |
| Wolfi rolling | kubescape | 3.0.34-r3 | — |
| Wolfi rolling | kyverno-notation-aws +1 | 1.1-r17 | — |
| Wolfi rolling | lazygit | 0.52.0-r1 | — |
| Wolfi rolling | neuvector-sigstore-interface | 0_git20250606-r0 | — |
| Wolfi rolling | nuclei | 3.4.4-r1 | — |
| Wolfi rolling | openbao +1 | 2.2.2-r1 | — |
| Wolfi rolling | opentofu-1.9 +1 | 1.9.1-r1 | — |
| Wolfi rolling | policy-controller +1 | 0.12.1-r2 | — |
| Wolfi rolling | pulumi +3 | 3.176.0-r0 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 1.16.0-r17 | — |
| Wolfi rolling | pulumi-language-dotnet | 3.82.1-r1 | — |
| Wolfi rolling | pulumi-language-java | 1.13.0-r0 | — |
| Wolfi rolling | q | 0.19.2-r18 | — |
| Wolfi rolling | rclone +1 | 1.69.3-r1 | — |
| Wolfi rolling | snyk-cli | 1.1297.1-r1 | — |
| Wolfi rolling | sops | 3.10.2-r1 | — |
| Wolfi rolling | src-fingerprint | 0.19.0-r30 | — |
| Wolfi rolling | terraform-provider-azurerm | 4.32.0-r1 | — |
| Wolfi rolling | terraform-provider-pagerduty | 3.26.0-r1 | — |
| Wolfi rolling | terragrunt +1 | 0.81.4-r0 | — |
| Wolfi rolling | tfsec | 1.28.14-r2 | — |
| Wolfi rolling | tkn | 0.41.0-r1 | — |
| Wolfi rolling | trufflehog | 3.89.1-r1 | — |
| Wolfi rolling | vcluster +3 | 0.25.1-r1 | — |
| Wolfi rolling | vexctl | 0.3.0-r14 | — |
| Wolfi rolling | wal-g +1 | 3.0.7-r8 | — |
| Wolfi rolling | xeol +1 | 0.10.8-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cloudflare/circl | < 1.6.1 | 1.6.1 | GHSA-2x5j-vhc8-9cwm |
Advisories 4
- openSUSE-SU-2026:10013-1 apptainer-1.4.5-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0439-1 Security update for apptainer SUSE / openSUSE Security Updates · Mar 23, 2026
- ALAS2023-2025-1359 Important: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026
- ALAS2-2025-3121 Important: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 5, 2026