CVE-2026-87733: mirage-crypto-ec ECDSA Auth Bypass Vulnerability

CVE-2026-87733 Overview

CVE-2026-87733 is a certificate and cryptographic validation flaw [CWE-295] in the mirage-crypto-ec library for OCaml, affecting versions prior to 2.2.0. The Elliptic Curve Digital Signature Algorithm (ECDSA) functions P256.Dsa.pub_of_octets, P384.Dsa.pub_of_octets, and P521.Dsa.pub_of_octets accept 0x00, which encodes the point at infinity, as a valid public key. An attacker who supplies this degenerate public key can forge ECDSA signatures without possessing the corresponding private key. The issue undermines signature integrity guarantees for any application that trusts public keys parsed through these functions.

Critical Impact
Attackers can forge valid ECDSA signatures on P-256, P-384, and P-521 curves without access to a private key, breaking authentication and integrity assumptions in dependent OCaml applications.

Affected Products

mirage-crypto-ec for OCaml, all versions prior to 2.2.0
OCaml applications and libraries linking mirage-crypto-ec for ECDSA verification
Downstream MirageOS unikernels relying on the affected ECDSA public key parser

Discovery Timeline

2026-09-09 - CVE-2026-87733 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87733

Vulnerability Analysis

The vulnerability resides in the ECDSA public key deserialization routines exposed by mirage-crypto-ec. The functions {P256,P384,P521}.Dsa.pub_of_octets fail to reject the encoding 0x00, which represents the point at infinity on the elliptic curve. Standards including SEC 1 and RFC 5480 require verifiers to reject the point at infinity because it is not a valid public key.

When the point at infinity is accepted as a public key, ECDSA verification degenerates. An attacker can construct signature values (r, s) that satisfy the verification equation against this pathological key without knowing any secret. Any protocol that accepts attacker-controlled public keys and later trusts signatures verified under those keys becomes vulnerable to authentication bypass and data tampering.

Root Cause

The root cause is missing input validation in the public key constructors. The parsers accept the octet string encoding 0x00 and return a public key object without enforcing the invariant that the decoded point must be a valid, non-identity element of the elliptic curve group. This maps to [CWE-295] Improper Certificate Validation, extended here to raw ECDSA key material.

Attack Vector

The CVSS vector indicates local access with no privileges or user interaction required, and integrity impact only. Exploitation requires an attacker to supply the crafted public key to a workflow that parses it with pub_of_octets and then verifies signatures. Typical scenarios include configuration files, key rotation flows, trust bundles, or embedded credentials that a local actor can influence. Once the malformed key is accepted, the attacker submits forged signatures that verify successfully, subverting integrity checks on messages, tokens, or software artifacts.

No verified proof-of-concept code is published in the referenced advisory. Technical detail is available in the OSV Vulnerability OSEC-2026-13 advisory.

Detection Methods for CVE-2026-87733

Indicators of Compromise

Presence of ECDSA public keys encoded as the single octet 0x00 in configuration stores, key files, or trust databases.
Application or library dependency manifests pinning mirage-crypto-ec at a version below 2.2.0.
Successful ECDSA verification events against unusually short or all-zero public key material recorded in application logs.

Detection Strategies

Perform software composition analysis (SCA) on OCaml projects and OPAM lockfiles to enumerate installations of mirage-crypto-ec below 2.2.0.
Add unit tests or runtime assertions that reject any ECDSA public key equal to the point at infinity before signature verification.
Audit code paths calling P256.Dsa.pub_of_octets, P384.Dsa.pub_of_octets, and P521.Dsa.pub_of_octets to confirm downstream validation of the returned key.

Monitoring Recommendations

Log and alert on ECDSA verification calls where the public key length or content is anomalous, including single-byte 0x00 encodings.
Monitor build pipelines and dependency updates for reintroductions of pre-2.2.0mirage-crypto-ec through transitive dependencies.
Review authentication and code-signing telemetry for unexpected identities validating against untrusted or newly added keys.

How to Mitigate CVE-2026-87733

Immediate Actions Required

Upgrade mirage-crypto-ec to version 2.2.0 or later across all OCaml projects and MirageOS unikernels.
Rebuild and redeploy any binaries statically linking the vulnerable library after upgrading.
Rotate ECDSA keys and re-verify trust bundles if there is evidence that attacker-controlled public keys were accepted.

Patch Information

The maintainers fixed the issue in mirage-crypto-ec version 2.2.0 by rejecting the point at infinity in the affected pub_of_octets functions. Refer to the OSV Vulnerability OSEC-2026-13 advisory for the authoritative patch reference and commit details.

Workarounds

Wrap calls to pub_of_octets with an explicit check that rejects the encoding 0x00 and any decoded point equal to the identity element.
Restrict the sources of ECDSA public keys to trusted, integrity-protected channels until the library is upgraded.
Where feasible, disable ECDSA verification paths that consume externally supplied public keys until patched builds are deployed.

bash

# Upgrade the affected package via OPAM
opam update
opam install mirage-crypto-ec.2.2.0
opam list mirage-crypto-ec