CVE-2026-54872

A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or SM2, using curves without dedicated constant-time implementations, variations in processing time leak information about the per-signature secret value. By measuring the duration of numerous signing operations, an attacker can analyze these timing differences to reconstruct the private signing key.

This issue is rated Moderate because generic elliptic-curve scalar multiplication used for ECDSA/SM2 on non-NIST curves can leak timing information about the secret nonce, which with many measurements may enable private-key recovery via lattice/HNP techniques. NIST P-256/P-384/P-521 dedicated paths are not affected, and FIPS-approved NIST curves in the FIPS provider are not affected. Attack complexity is high due to the volume of precise timing samples required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prefer NIST curves with dedicated constant-time implementations (P-256, P-384, P-521) for ECDSA. Avoid Brainpool and other generic prime curves for high-value signing where practical.