CVE-2022-44310

HIGH

ecdh < 0.2.0 - Exposure of Resource to Wrong Sphere via Invalid Public Key

Title source: llm
STIX 2.1

Description

In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0025
EPSS Percentile 48.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-668
Status published
Products (2)
ecdh_project/ecdh < 0.2.0
npm/ecdh 0 - 0.2.0npm
Published Feb 24, 2023
Tracked Since Feb 18, 2026