{"id":"CVE-2026-3706","summary":"mkj Dropbear S Range Check curve25519.c unpackneg signature verification","details":"A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch. The project maintainer explains: \"Signature Malleability is not exploitable in SSH protocol. (...) [A] PoC doesn't exist for SSH implementation, but rather it's against the internal API.\"","modified":"2026-08-12T16:23:54.718519Z","published":"2026-03-08T05:02:11.136Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3706.json","unresolved_ranges":[{"extracted_events":[{"introduced":"2025.0"},{"last_affected":"2025.0"},{"introduced":"2025.1"},{"last_affected":"2025.1"},{"introduced":"2025.2"},{"last_affected":"2025.2"},{"introduced":"2025.3"},{"last_affected":"2025.3"},{"introduced":"2025.4"},{"last_affected":"2025.4"},{"introduced":"2025.5"},{"last_affected":"2025.5"},{"introduced":"2025.6"},{"last_affected":"2025.6"},{"introduced":"2025.7"},{"last_affected":"2025.7"},{"introduced":"2025.8"},{"last_affected":"2025.8"},{"introduced":"2025.9"},{"last_affected":"2025.9"},{"introduced":"2025.10"},{"last_affected":"2025.10"},{"introduced":"2025.11"},{"last_affected":"2025.11"},{"introduced":"2025.12"},{"last_affected":"2025.12"},{"introduced":"2025.13"},{"last_affected":"2025.13"},{"introduced":"2025.14"},{"last_affected":"2025.14"},{"introduced":"2025.15"},{"last_affected":"2025.15"},{"introduced":"2025.16"},{"last_affected":"2025.16"},{"introduced":"2025.17"},{"last_affected":"2025.17"},{"introduced":"2025.18"},{"last_affected":"2025.18"},{"introduced":"2025.19"},{"last_affected":"2025.19"},{"introduced":"2025.20"},{"last_affected":"2025.20"},{"introduced":"2025.21"},{"last_affected":"2025.21"},{"introduced":"2025.22"},{"last_affected":"2025.22"},{"introduced":"2025.23"},{"last_affected":"2025.23"},{"introduced":"2025.24"},{"last_affected":"2025.24"},{"introduced":"2025.25"},{"last_affected":"2025.25"},{"introduced":"2025.26"},{"last_affected":"2025.26"},{"introduced":"2025.27"},{"last_affected":"2025.27"},{"introduced":"2025.28"},{"last_affected":"2025.28"},{"introduced":"2025.29"},{"last_affected":"2025.29"},{"introduced":"2025.30"},{"last_affected":"2025.30"},{"introduced":"2025.31"},{"last_affected":"2025.31"},{"introduced":"2025.32"},{"last_affected":"2025.32"},{"introduced":"2025.33"},{"last_affected":"2025.33"},{"introduced":"2025.34"},{"last_affected":"2025.34"},{"introduced":"2025.35"},{"last_affected":"2025.35"},{"introduced":"2025.36"},{"last_affected":"2025.36"},{"introduced":"2025.37"},{"last_affected":"2025.37"},{"introduced":"2025.38"},{"last_affected":"2025.38"},{"introduced":"2025.39"},{"last_affected":"2025.39"},{"introduced":"2025.40"},{"last_affected":"2025.40"},{"introduced":"2025.41"},{"last_affected":"2025.41"},{"introduced":"2025.42"},{"last_affected":"2025.42"},{"introduced":"2025.43"},{"last_affected":"2025.43"},{"introduced":"2025.44"},{"last_affected":"2025.44"},{"introduced":"2025.45"},{"last_affected":"2025.45"},{"introduced":"2025.46"},{"last_affected":"2025.46"},{"introduced":"2025.47"},{"last_affected":"2025.47"},{"introduced":"2025.48"},{"last_affected":"2025.48"},{"introduced":"2025.49"},{"last_affected":"2025.49"},{"introduced":"2025.50"},{"last_affected":"2025.50"},{"introduced":"2025.51"},{"last_affected":"2025.51"},{"introduced":"2025.52"},{"last_affected":"2025.52"},{"introduced":"2025.53"},{"last_affected":"2025.53"},{"introduced":"2025.54"},{"last_affected":"2025.54"},{"introduced":"2025.55"},{"last_affected":"2025.55"},{"introduced":"2025.56"},{"last_affected":"2025.56"},{"introduced":"2025.57"},{"last_affected":"2025.57"},{"introduced":"2025.58"},{"last_affected":"2025.58"},{"introduced":"2025.59"},{"last_affected":"2025.59"},{"introduced":"2025.60"},{"last_affected":"2025.60"},{"introduced":"2025.61"},{"last_affected":"2025.61"},{"introduced":"2025.62"},{"last_affected":"2025.62"},{"introduced":"2025.63"},{"last_affected":"2025.63"},{"introduced":"2025.64"},{"last_affected":"2025.64"},{"introduced":"2025.65"},{"last_affected":"2025.65"},{"introduced":"2025.66"},{"last_affected":"2025.66"},{"introduced":"2025.67"},{"last_affected":"2025.67"},{"introduced":"2025.68"},{"last_affected":"2025.68"},{"introduced":"2025.69"},{"last_affected":"2025.69"},{"introduced":"2025.70"},{"last_affected":"2025.70"},{"introduced":"2025.71"},{"last_affected":"2025.71"},{"introduced":"2025.72"},{"last_affected":"2025.72"},{"introduced":"2025.73"},{"last_affected":"2025.73"},{"introduced":"2025.74"},{"last_affected":"2025.74"},{"introduced":"2025.75"},{"last_affected":"2025.75"},{"introduced":"2025.76"},{"last_affected":"2025.76"},{"introduced":"2025.77"},{"last_affected":"2025.77"},{"introduced":"2025.78"},{"last_affected":"2025.78"},{"introduced":"2025.79"},{"last_affected":"2025.79"},{"introduced":"2025.80"},{"last_affected":"2025.80"},{"introduced":"2025.81"},{"last_affected":"2025.81"},{"introduced":"2025.82"},{"last_affected":"2025.82"},{"introduced":"2025.83"},{"last_affected":"2025.83"},{"introduced":"2025.84"},{"last_affected":"2025.84"},{"introduced":"2025.85"},{"last_affected":"2025.85"},{"introduced":"2025.86"},{"last_affected":"2025.86"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-345","CWE-347"],"isDisputed":true},"references":[{"type":"WEB","url":"https://github.com/mkj/dropbear/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3706.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3706"},{"type":"ADVISORY","url":"https://vuldb.com/?id.349652"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.765933"},{"type":"REPORT","url":"https://github.com/mkj/dropbear/issues/406"},{"type":"REPORT","url":"https://github.com/str4d/ed25519-java/issues/82#issue-727629226"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.349652"},{"type":"FIX","url":"https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d"},{"type":"FIX","url":"https://github.com/mkj/dropbear/pull/407"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mkj/dropbear","events":[{"introduced":"e2f854c2b5d4f3169b97746fa1a6cfa93f50413e"},{"fixed":"fdec3c90a15447bd538641d85e5a3e3ac981011d"}],"database_specific":{"extracted_events":[{"introduced":"2025.87"},{"last_affected":"2025.87"},{"introduced":"2025.88"},{"last_affected":"2025.88"},{"introduced":"2025.89"},{"last_affected":"2025.89"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2025.87","2025.88","2025.89","DROPBEAR_2025.89","DROPBEAR_2025.88","DROPBEAR_2025.87"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3706.json","vanir_signatures_modified":"2026-08-12T16:23:54Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d","target":{"file":"src/curve25519.c","function":"dropbear_ed25519_verify"},"deprecated":false,"digest":{"function_hash":"213814948035677939021544121219517236664","length":605},"id":"CVE-2026-3706-0bef24fa","signature_type":"Function"},{"source":"https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d","target":{"file":"src/curve25519.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["112220256655486656090191606025939260953","276454567933484885337984990012792280676","91306894696134992414631438177588220079","132864368077499674925325667809892516326","252642720523952594901071120225862025929","65629044967754013180717541473774794045"]},"id":"CVE-2026-3706-ffd293fb","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}]}