CVE-2026-55174

MEDIUM 5.9

UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.

CWE	CWE-345 CWE-347
Vendor	shrec
Product	ultrafastsecp256k1
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for shrec ultrafastsecp256k1

Be the first to know when new medium vulnerabilities affecting shrec ultrafastsecp256k1 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

shrec / UltrafastSecp256k1

< 4.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/shrec/UltrafastSecp256k1/security/advisories/GHSA-c7q2-gv3g-rgxm github.com: https://github.com/shrec/UltrafastSecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981 github.com: https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.0 github.com: https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.1