Untriaged
Permalink
CVE-2026-2681
5.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): LOW
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package haskellPackages.hsblst
Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generation
A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst_sha256_bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation functions, such as blst_keygen_v5(), if the application exposes this functionality. Successful exploitation leads to memory corruption and immediate process termination, resulting in a denial-of-service (DoS) condition.
References
- RHBZ#2440580 issue-tracking x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-2681 x_refsource_REDHAT vdb-entry
Affected products
blst
- =<0.3.16
Matching in nixpkgs
Package maintainers
-
@iquerejeta Inigo Querejeta-Azurmendi
-
@yvan-sraka Yvan Sraka <yvan@sraka.xyz>