Skip to content
Fencer Vulns
low 3.7

CVE-2025-8556 json

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

published 2025-06-10 16 mo ago modified 2026-11-06 2 d ago also GHSA-2x5j-vhc8-9cwm , GO-2025-3754 , EUVD-2025-23815

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

Patch / fix

  • go github.com/cloudflare/circl 1.6.1
  • golang-github-cloudflare-circl Debian 14, Debian 13 1.6.1-1

debian advisories DEBIAN-CVE-2025-8556

  • apptainer SLES 15 SP6-LTSS, SLE Module for HPC 15 SP7, openSUSE Leap 15.6 1.4.5-150600.4.12.1
  • squashfuse SLES 15 SP6-LTSS, SLE Module for HPC 15 SP7, openSUSE Leap 15.6 0.5.0-150600.3.2.1

suse advisories SUSE-SU-2026:0439-1

  • apptainer openSUSE Tumbleweed 1.4.5-1.1

opensuse advisories openSUSE-SU-2026:10013-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-8556 updated cvss 3.7

github.com/cloudflare/circl: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results

  • Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, openshift-builds/openshift-builds-image-bundler-rhel9, openshift-builds/openshift-builds-image-processing-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-nop-rhel8, openshift-pipelines/pipelines-nop-rhel9, openshift-pipelines/pipelines-events-rhel8, openshift-pipelines/pipelines-events-rhel9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, +21 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel8, openshift-serverless-1/kn-plugin-event-sender-rhel8, openshift-serverless-1/kn-client-cli-artifacts-rhel8, openshift-serverless-1/kn-plugin-func-func-util-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, openshift-service-mesh/istio-sail-operator-bundle, +1 more Red Hat Advanced Cluster Management for Kubernetes 2 flightctl, flightctl-agent, flightctl-selinux, rhacm2/subctl-rhel9, rhacm2/volsync-rhel9, rhacm2/acm-grafana-rhel9, +4 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, +4 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhel9/grafana, rhceph/grafana-rhel9 Red Hat Ceph Storage 6 rhel9/grafana, rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhel9/grafana, rhceph/grafana-rhel9 Red Hat Developer Hub 1 rhdh-orchestrator-dev-preview-beta/controller-rhel9-operator, rhdh-orchestrator-dev-preview-beta/orchestrator-operator-bundle Red Hat Edge Manager preview flightctl, rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhem/flightctl-periodic-rhel9, +4 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AI (RHEL AI) rhelai1/ui-rhel9, rhelai1/pathservice-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-olm-rukpak-rhel8, openshift4/ose-olm-rukpak-rhel9, openshift4/ose-cluster-api-rhel9, openshift4/o-cloud-manager-rhel9-operator, +5 more Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-rhel9-operator, devworkspace/devworkspace-operator-bundle, devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator, openshift4-wincw/windows-machine-config-operator-bundle
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/argo-rollouts-rhel8
    affected: workaround, no fix planned “Will not fix”
show 4 more
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenStack Platform 16.2 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-operator, rhosp-rhel9/osp-director-downloader Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-operator, rhosp-rhel9/osp-director-downloader
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Trusted Application Pipeline rhtap-task-runner/rhtap-task-runner-rhel9 Red Hat Trusted Artifact Signer rhtas/cosign-rhel9, rhtas/gitsign-rhel9, rhtas/tuf-server-rhel9, rhtas/client-server-rhel9, rhtas/createctconfig-rhel9, rhtas/trillian-createdb-rhel9, +2 more Red Hat Trusted Profile Analyzer rhtpa/rhtpa-guac-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 rhel9/grafana Red Hat Enterprise Linux 10 rhel10/grafana Red Hat Enterprise Linux AI (RHEL AI) rhelai1/bootc-amd-rhel9, rhelai1/bootc-nvidia-rhel9, rhelai1/bootc-azure-amd-rhel9, rhelai1/instructlab-amd-rhel9, rhelai1/bootc-aws-nvidia-rhel9, rhelai1/bootc-gcp-nvidia-rhel9, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/cloudflare/circl
<1.6.1
1.6.1

Affected products

  • Red Hat Builds for Red Hat OpenShift
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift
  • Red Hat Multicluster Global Hub
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Ceph Storage 5
  • Red Hat Red Hat Ceph Storage 6
  • Red Hat Red Hat Ceph Storage 8
  • Red Hat Red Hat Developer Hub 1
  • Red Hat Red Hat Edge Manager preview
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI)
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Dev Workspaces Operator
  • Red Hat Red Hat OpenShift for Windows Containers
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat Trusted Application Pipeline
  • Red Hat Red Hat Trusted Artifact Signer
  • Red Hat Red Hat Trusted Profile Analyzer

Classification

Weakness
  • CWE-1287 Improper Validation of Specified Type of Input
  • CWE-20 Improper Input Validation
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.