Input validation error in python-ecdsa - CVE-2026-33936

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128356

Input validation error in python-ecdsa - CVE-2026-33936

Published: April 28, 2026


Vulnerability identifier: #VU128356
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33936
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in SigningKey.from_der() when parsing untrusted DER private keys. A remote attacker can supply a specially crafted DER input to cause a denial of service.

The issue can trigger an internal IndexError instead of cleanly rejecting malformed DER.


Affected software

python-ecdsa
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
Basesystem Module
openSUSE Leap
openEuler
python3-ecdsa
python-ecdsa
python-ecdsa-help
python2-ecdsa
python311-ecdsa

How to mitigate CVE-2026-33936

Install security update from vendor's website.

python-ecdsa - update to 0.19.2
python3-ecdsa - update to 0.13.3-150000.3.10.1
python3-ecdsa - addressed in versions 0.16.1-2, 0.17.0-4, 0.18.0-3
python-ecdsa - addressed in versions 0.16.1-2, 0.17.0-4, 0.18.0-3
python-ecdsa-help - addressed in versions 0.16.1-2, 0.17.0-4, 0.18.0-3
python2-ecdsa - update to 0.16.1-2
python311-ecdsa - update to 0.18.0-150400.12.6.1

External References

Related Security Bulletins