CVE-2026-3706: mkj Dropbear RCE Vulnerability

CVE-2026-3706 Overview

A cryptographic signature verification vulnerability has been identified in mkj Dropbear SSH server up to version 2025.89. The vulnerability affects the unpackneg function within src/curve25519.c, specifically in the S Range Check component. This flaw allows improper verification of cryptographic signatures, which could potentially be exploited by remote attackers to bypass signature validation in Ed25519 operations.

Critical Impact

Remote attackers may exploit improper S range validation in Ed25519 signature verification to potentially forge or manipulate cryptographic signatures, though exploitation is considered difficult due to high attack complexity.

Affected Products

• mkj Dropbear SSH up to version 2025.89
• Systems using Dropbear's curve25519 implementation for Ed25519 signatures
• Embedded devices and IoT systems commonly running Dropbear SSH

Discovery Timeline

• 2026-03-08 - CVE-2026-3706 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-3706

Vulnerability Analysis

This vulnerability stems from insufficient input validation in the Ed25519 signature verification process within Dropbear's curve25519 implementation. The issue is classified under CWE-345 (Insufficient Verification of Data Authenticity), indicating that the cryptographic signature verification routine fails to properly validate that the S component of an Ed25519 signature falls within the correct range (S < L, where L is the order of the base point).

In Ed25519 signatures, the S value must be less than L to be considered valid. Without this check, signatures with S values outside the expected range could potentially pass verification when they should be rejected, creating a signature malleability issue. While exploitation requires sophisticated cryptographic knowledge and the attack complexity is considered high, successful exploitation could undermine the integrity guarantees provided by Ed25519 signatures.

Root Cause

The root cause is the absence of a range check to verify that the S component of an Ed25519 signature is less than L (the group order). The unpackneg function in src/curve25519.c did not include validation to ensure S < L before proceeding with signature verification operations. This oversight allows signatures with non-canonical S values to potentially pass verification.

Attack Vector

The vulnerability is exploitable remotely over the network, though it requires high attack complexity. An attacker would need to craft specially malformed Ed25519 signatures with S values outside the valid range and submit them to a system running vulnerable versions of Dropbear SSH. The attack targets the signature verification process during SSH authentication or other cryptographic operations using the affected curve25519 implementation.

// Security patch adding S < L range check
// Source: https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d

   return 0;
 }
 
+/* Return 0 if S < L, -1 otherwise.
+ * Only used during verify so timing side-channel is OK */
+static int s_lt_l(const u8 *s) {
+  int i;
+  for (i = 31; i >= 0; i--) {
+    if (s[i] < L[i]) {
+      return 0;
+    }
+    if (s[i] > L[i]) {
+      return -1;
+    }
+  }
+  return -1;
+}
+
 int dropbear_ed25519_verify(const u8 *m,u32 mlen,const u8 *s,u32 slen,const u8 *pk)
 {
   hash_state hs;

The patch introduces the s_lt_l() function that performs a byte-by-byte comparison to ensure the signature's S component is strictly less than L. This function is intentionally not constant-time as it's only used during verification where timing side-channels are acceptable.

Detection Methods for CVE-2026-3706

Indicators of Compromise

• Unusual SSH authentication patterns with malformed signature data
• Log entries indicating signature verification failures followed by unexpected successes
• Network traffic containing Ed25519 signatures with non-canonical S values

Detection Strategies

• Monitor Dropbear SSH logs for anomalous authentication behavior
• Implement network intrusion detection rules to identify potentially malformed Ed25519 signatures
• Perform version auditing to identify systems running Dropbear versions up to 2025.89

Monitoring Recommendations

• Enable verbose logging on Dropbear SSH servers to capture detailed authentication events
• Deploy SentinelOne agents on systems running Dropbear to detect exploitation attempts
• Establish baseline SSH authentication patterns to identify deviations that may indicate exploitation

How to Mitigate CVE-2026-3706

Immediate Actions Required

• Identify all systems running mkj Dropbear SSH up to version 2025.89
• Apply the security patch with commit hash fdec3c90a15447bd538641d85e5a3e3ac981011d
• Review SSH authentication logs for any suspicious activity prior to patching
• Consider temporarily restricting SSH access to trusted networks until patching is complete

Patch Information

The vulnerability has been addressed in the official Dropbear repository. The fix introduces proper S < L range checking in the Ed25519 signature verification routine. Organizations should apply the patch identified by commit fdec3c90a15447bd538641d85e5a3e3ac981011d or upgrade to a patched version when available. For detailed patch information, refer to the GitHub Pull Request and the GitHub Commit Details.

Workarounds

• Restrict SSH access to trusted IP ranges using firewall rules
• Implement additional authentication mechanisms such as certificate-based authentication
• Monitor for and block unusual signature patterns at the network level
• Consider using alternative SSH implementations until patching is feasible

# Example: Restrict SSH access to trusted networks using iptables
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

# Verify Dropbear version to check if vulnerable
dropbear -V 2>&1 | head -1