A flaw in the unpackneg function in src/curve25519.c of Dropbear up to 2025.89 causes the SSH server to accept signatures that should otherwise be rejected. The vulnerability may allow a remote attacker, using a complex and difficult exploitation technique, to trick the server into accepting malformed or malicious data. The project maintainer notes that signature malleability is not directly exploitable in the SSH protocol itself and that a proof‑of‑concept has not been demonstrated against the SSH implementation, only against the internal API.

Dropbear SSH server (maintained by mkj) with versions 2025.89 and earlier.

The CVSS score is 6.3, indicating medium severity, while the EPSS score is below 1 %, signaling a low probability of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. The flaw can be triggered remotely, but it requires high attacker skill and the current evidence for a working exploit is uncertain. Consequently, the overall risk is moderate but the likelihood of actual compromise is low.