CVE-2026-87737: mirage-crypto-ec Timing Side Channel Flaw

CVE-2026-87737 Overview

CVE-2026-87737 is a timing side channel vulnerability in the mirage-crypto-ec package for OCaml before version 2.4.0. The flaw affects NIST elliptic-curve scalar multiplication operations. The time required for a lookup can depend on a secret value, enabling attackers to infer private key material through timing measurements. The vulnerability is classified under [CWE-208] (Observable Timing Discrepancy).

Critical Impact
Attackers with the ability to measure precise cryptographic operation timings can potentially recover secret scalar values used in elliptic-curve cryptographic operations, undermining confidentiality of protected data.

Affected Products

mirage-crypto-ec package for OCaml, all versions prior to 2.4.0
Applications and libraries depending on mirage-crypto-ec for NIST elliptic-curve operations
MirageOS unikernels and OCaml-based TLS stacks using affected versions

Discovery Timeline

2026-09-09 - CVE-2026-87737 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87737

Vulnerability Analysis

The vulnerability resides in the scalar multiplication routines used for NIST elliptic curves in mirage-crypto-ec. Scalar multiplication is the core operation in Elliptic Curve Cryptography (ECC), computing k*P where k is a secret scalar and P is a curve point. Constant-time implementations are required so that execution time does not leak information about k.

In versions prior to 2.4.0, a table lookup during scalar multiplication executes in variable time depending on the secret input. An attacker who can observe the timing of these operations, either locally or over a network, may correlate timing variations with bits of the secret scalar. Repeated measurements can allow reconstruction of private keys used in signing and key-exchange operations such as ECDSA and ECDH.

Root Cause

The root cause is a non-constant-time memory access pattern in the point lookup routine used during scalar multiplication. Lookups that branch or index based on secret data introduce microarchitectural timing variance through cache access patterns and instruction paths. This violates the constant-time programming discipline required for secure cryptographic implementations.

Attack Vector

Exploitation requires the attacker to make numerous cryptographic requests and measure response timings with high precision. Remote timing attacks against ECC implementations have been demonstrated in academic literature, though practical exploitation depends on network jitter, the number of samples collected, and the volume of signing operations performed with the same key. Local co-tenant attackers on shared hardware face lower barriers due to reduced measurement noise.

See the OSV Vulnerability Report OSEC-2026-17 for additional technical detail on the affected code paths.

Detection Methods for CVE-2026-87737

Indicators of Compromise

Anomalously high volumes of ECC signing or key-exchange requests originating from a single source, consistent with timing measurement campaigns
Repeated failed or duplicate requests targeting endpoints that perform NIST curve operations (P-256, P-384, P-521)
Sustained low-and-slow request patterns against TLS or signing services backed by OCaml applications

Detection Strategies

Inventory OCaml dependencies across build systems and container images to identify mirage-crypto-ec versions below 2.4.0
Use software composition analysis (SCA) tools to flag vulnerable package versions in opam lockfiles and OCaml project manifests
Review TLS and cryptographic service logs for unusual request-rate patterns from individual peers

Monitoring Recommendations

Alert on abnormal request rates against services that perform ECDSA signatures or ECDH key agreement using NIST curves
Correlate network telemetry with cryptographic operation counts to identify measurement-oriented traffic
Track upstream advisories from the MirageOS project and OSV feed for related package updates

How to Mitigate CVE-2026-87737

Immediate Actions Required

Upgrade mirage-crypto-ec to version 2.4.0 or later across all OCaml projects and rebuild dependent artifacts
Rotate any long-lived ECC private keys that were used with vulnerable versions in exposed services
Audit deployed unikernels, container images, and packaged applications for embedded vulnerable versions

Patch Information

The issue is fixed in mirage-crypto-ec version 2.4.0. Update the dependency constraint in opam project files and re-run opam install or the equivalent build step. Consult the OSV Vulnerability Report OSEC-2026-17 for authoritative fix references.

Workarounds

Restrict network exposure of services that perform ECC operations with untrusted peers until patching is complete
Rate-limit cryptographic operations per client to reduce the feasibility of timing measurement attacks
Where feasible, route ECC operations through a hardened cryptographic library with verified constant-time implementations until the upgrade is applied

bash

# Verify installed mirage-crypto-ec version and upgrade via opam
opam list mirage-crypto-ec
opam update
opam install "mirage-crypto-ec>=2.4.0"