CVE-2019-10764

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-18 · updated 2026-06-17
Weakness: CWE-203

Description

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.

Affected products

simplito/elliptic-php: before 1.0.6 — fixed in 1.0.6

How to fix

Upgrade to a fixed version: simplito/elliptic-php 1.0.6. Check the vendor advisory for mitigations.

References

https://minerva.crocs.fi.muni.cz/
https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576
https://minerva.crocs.fi.muni.cz/
https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576

Get alerted when CVE-2019-10764 or the next vulnerability affects your stack