What is the CVSS score of CVE-2026-1229?

CVE-2026-1229 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Github are affected by CVE-2026-1229?

A critical vulnerability in CIRCL's elliptic curve cryptography implementation (CVE-2026-1229, CVSS 9.8) affects organizations using secp384r1 curve operations, potentially compromising cryptographic…. A patch is available.

How to fix or mitigate CVE-2026-1229?

Within 24 hours: Inventory all applications and systems using CIRCL ecc/p384 package and assess exposure scope; notify security teams and relevant business units. Within 7 days: Implement network segmentation and access controls around affected systems; engage vendor for patch ETA and interim guidance; evaluate alternative cryptographic libraries for migration feasibility. Within 30 days: Execute remediation plan—either apply vendor patch immediately upon release or migrate to alternative vetted elliptic curve implementations; validate cryptographic operations post-remediation.

Github CVE-2026-1229

CRITICAL

Incorrect Calculation (CWE-682)

2026-02-24 cna@cloudflare.com

GHSA-q9hv-hpm4-hj6x

Github Circl Suse Cloudflare

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 08:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

AnalysisAI

Incorrect computation in CIRCL cryptographic library's CombinedMult function for secp384r1 (P-384) curve. Produces wrong elliptic curve multiplication results for specific inputs, potentially breaking ECDSA signature verification.

Technical ContextAI

CWE-682 incorrect calculation in CombinedMult for secp384r1. The CIRCL library (Cloudflare's Go cryptographic library) produces incorrect results for specific P-384 inputs, which could cause ECDSA verification to accept invalid signatures or reject valid ones.

RemediationAI

Update CIRCL library immediately. Applications using CIRCL for P-384 operations should verify cryptographic operations after update.

More in Github

View all

CVE-2026-1699 CRITICAL Act Now POC

10.0 Jan 30

Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target w

CVE-2026-27941 CRITICAL Act Now POC

9.9 Feb 26

Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma

CVE-2026-22869 CRITICAL Act Now POC

9.8 Jan 13

Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a

CVE-2026-28215 CRITICAL Act Now POC

9.1 Feb 26

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit

CVE-2018-1000600 HIGH This Week POC

8.8 Jun 26

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede

CVE-2026-30920 HIGH This Week POC

8.6 Mar 10

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by

CVE-2026-25221 HIGH This Week POC

8.1 Feb 02

PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab

CVE-2026-23644 HIGH This Week POC

7.5 Jan 18

Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers

CVE-2025-68619 HIGH This Week POC

7.2 Jan 01

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore i

CVE-2026-27943 MEDIUM This Month POC

6.5 Feb 26

Authenticated users in OpenEMR through version 8.0.0 can access and modify eye exam records belonging to other patients

CVE-2026-23889 MEDIUM This Month POC

6.5 Jan 26

Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire

CVE-2026-27612 MEDIUM This Month POC

6.1 Feb 25

Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc

Same weakness CWE-682 – Incorrect Calculation

View all

CVE-2021-44847 CRITICAL POC

9.8

CVE-2022-23066 CRITICAL POC

9.1

CVE-2022-28048 HIGH POC

8.8

CVE-2020-0022 HIGH POC

8.8

CVE-2019-16346 HIGH POC

8.8

CVE-2023-42460 HIGH POC

7.5

CVE-2022-22138 HIGH POC

7.5

CVE-2022-30780 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Tumbleweed	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-1229 vulnerability details – vuln.today

Back

Github CVE-2026-1229

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Github

Same weakness CWE-682 – Incorrect Calculation

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code