CVE-2026-54872

The vulnerability is a timing side‑channel in the generic elliptic‑curve scalar multiplication routine used by OpenSSL for ECDSA and SM2 signature operations on non‑NIST curves. The scalar multiplication pads the secret scalar with non constant‑time BIGNUM operations, so the execution time depends on the value of the secret nonce. An attacker who can measure the time taken for many signature operations can recover information about the per‑signature nonce, and over a large number of signatures can apply lattice or Hidden Number Problem techniques to reconstruct the private key. The leak is very small and requires a large volume of timing measurements, but with sufficient data it can lead to a full key compromise.

Any instance of OpenSSL executing ECDSA or SM2 signatures on non‑NIST curves that rely on the generic scalar multiplication path is affected. Curves such as brainpoolP384r1 are particularly vulnerable. The NIST curves P-256, P-384, and P-521 use dedicated constant‑time implementations and are not affected, nor are the FIPS modules. The issue is present in OpenSSL repositories before the patches referenced in the commit URLs, and applies to deployments that use the default generic EC implementation.

The CVSS score is 3.7, indicating a low to moderate severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting exploitation is not common at present. The attack requires many precise timing measurements, so the effort is high, especially for remote or distributed signing services. However, if an adversary can observe or induce a large number of signature operations, the information leakage could eventually lead to a private key compromise. The vulnerability is therefore moderate risk in environments where signing operations are exposed and high volumes of signatures can be collected.