CVE-2024-48948
elliptic: ECDSA signature verification error may reject legitimate transactions
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 15, 2024
Updated · October 27, 2026
Description
A flaw was found in the Elliptic Node.js package. In certain versions, the ECDSA implementation does not correctly verify valid signatures if the hash contains at least 4 leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash. This issue can lead to valid signatures being rejected and a potential service disruption.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-222 · Truncation of Security-relevant Information