Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b71f-55vq-b3eg
Vulnerability ID VCID-b71f-55vq-b3eg
Aliases CVE-2025-14505
GHSA-848j-6mx2-7j84
Summary The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This happens, because the byte-length of 'k' is incorrectly computed, resulting in its getting truncated during the computation. Legitimate transactions or communications will be broken as a result. Furthermore, due to the nature of the fault, attackers could–under certain conditions–derive the secret key, if they could get their hands on both a faulty signature generated by a vulnerable version of Elliptic and a correct signature for the same inputs. This issue affects all known versions of Elliptic (at the time of writing, versions less than or equal to 6.6.1).
Status Published
Exploitability 0.5
Weighted Severity 5.0
Risk 2.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14505.json
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-14505
cvssv3.1_qr LOW https://github.com/advisories/GHSA-848j-6mx2-7j84
cvssv3.1 5.6 https://github.com/indutny/elliptic
cvssv4 2.9 https://github.com/indutny/elliptic
generic_textual LOW https://github.com/indutny/elliptic
cvssv3.1 5.6 https://github.com/indutny/elliptic/issues/321
cvssv4 2.9 https://github.com/indutny/elliptic/issues/321
generic_textual LOW https://github.com/indutny/elliptic/issues/321
ssvc Track https://github.com/indutny/elliptic/issues/321
cvssv3.1 5.6 https://nvd.nist.gov/vuln/detail/CVE-2025-14505
cvssv4 2.9 https://nvd.nist.gov/vuln/detail/CVE-2025-14505
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-14505
cvssv3.1 5.6 https://www.herodevs.com/vulnerability-directory/cve-2025-14505
cvssv4 2.9 https://www.herodevs.com/vulnerability-directory/cve-2025-14505
generic_textual LOW https://www.herodevs.com/vulnerability-directory/cve-2025-14505
ssvc Track https://www.herodevs.com/vulnerability-directory/cve-2025-14505
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14505.json
https://api.first.org/data/v1/epss?cve=CVE-2025-14505
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14505
https://github.com/indutny/elliptic
1125180 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125180
2428154 https://bugzilla.redhat.com/show_bug.cgi?id=2428154
321 https://github.com/indutny/elliptic/issues/321
cve-2025-14505 https://www.herodevs.com/vulnerability-directory/cve-2025-14505
CVE-2025-14505 https://nvd.nist.gov/vuln/detail/CVE-2025-14505
GHSA-848j-6mx2-7j84 https://github.com/advisories/GHSA-848j-6mx2-7j84
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-14505.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/indutny/elliptic
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P Found at https://github.com/indutny/elliptic
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/indutny/elliptic/issues/321
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P Found at https://github.com/indutny/elliptic/issues/321
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T21:22:47Z/ Found at https://github.com/indutny/elliptic/issues/321
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2025-14505
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2025-14505
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.herodevs.com/vulnerability-directory/cve-2025-14505
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P Found at https://www.herodevs.com/vulnerability-directory/cve-2025-14505
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-08T21:22:47Z/ Found at https://www.herodevs.com/vulnerability-directory/cve-2025-14505
Exploit Prediction Scoring System (EPSS)
Percentile 0.01055
EPSS Score 9e-05
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:03:18.421203+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/14xxx/CVE-2025-14505.json 38.6.0