{"id":"JLSEC-2026-682","summary":"Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a...","details":"Generating the ECDSA nonce k samples a random number r and then\ntruncates this randomness with a modular reduction mod n where n is the\norder of the elliptic curve. Meaning k = r mod n. The division used\nduring the reduction estimates a factor `q_e` by dividing the upper two\ndigits (a digit having e.g. a size of 8 byte) of r by the upper digit of\nn and then decrements `q_e` in a loop until it has the correct size.\nObserving the number of times `q_e` is decremented through a control-flow\nrevealing side-channel reveals a bias in the most significant bits of\nk. Depending on the curve this is either a negligible bias or a\nsignificant bias large enough to reconstruct k with lattice reduction\nmethods. For SECP160R1, e.g., we find a bias of 15 bits.","modified":"2026-07-25T18:23:59.613307985Z","published":"2026-07-14T21:41:35.775Z","upstream":["CVE-2024-1544","GHSA-grjj-54gm-q5vf","EUVD-2024-17291"],"database_specific":{"sources":[{"id":"CVE-2024-1544","imported":"2026-07-17T22:24:21.232Z","modified":"2026-06-17T07:04:27.800Z","published":"2024-08-27T19:15:16.547Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1544","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1544","database_specific":{"status":"Modified"}},{"modified":"2026-01-28T00:31:38Z","published":"2024-08-27T21:31:13Z","url":"https://api.github.com/advisories/GHSA-grjj-54gm-q5vf","html_url":"https://github.com/advisories/GHSA-grjj-54gm-q5vf","id":"GHSA-grjj-54gm-q5vf","imported":"2026-07-17T22:24:21.436Z"},{"html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-17291","id":"EUVD-2024-17291","imported":"2026-07-17T22:24:31.177Z","modified":"2026-01-27T21:58:42Z","published":"2024-08-27T18:44:52Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2024-17291"}],"license":"CC-BY-4.0"},"references":[{"type":"WEB","url":"https://github.com/advisories/GHSA-grjj-54gm-q5vf"},{"type":"WEB","url":"https://github.com/wolfSSL/wolfssl/pull/7020"},{"type":"WEB","url":"https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.2-stable"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1544"}],"affected":[{"package":{"name":"wolfSSL_jll","ecosystem":"Julia","purl":"pkg:julia/wolfSSL_jll?uuid=98c43586-9870-5ae5-ab22-acc77b9bbdb5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.7.2+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-682.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}]}