{"cve":"CVE-2026-33936","nvd":{"published":"2026-03-27T23:17:13.733","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is parsed successfully instead of being rejected. Because of that, a crafted DER input can cause `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`) rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service. Version 0.19.2 patches the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-20","CWE-130"],"references":["https://github.com/tlsfuzzer/python-ecdsa/commit/bd66899550d7185939bf27b75713a2ac9325a9d3","https://github.com/tlsfuzzer/python-ecdsa/releases/tag/python-ecdsa-0.19.2","https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-9f5j-8jwj-x28g"],"products":["tlsfuzzer:ecdsa"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-33936","score":0.00485,"percentile":0.4146,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-9f5j-8jwj-x28g","url":"https://osv.dev/vulnerability/GHSA-9f5j-8jwj-x28g","summary":"python-ecdsa: Denial of Service via improper DER length validation in crafted private keys","modified":"2026-09-10T03:51:00.142533331Z","packages":[{"ecosystem":"PyPI","name":"ecdsa","purl":"pkg:pypi/ecdsa","ranges":["<0.19.2"],"fixed":["0.19.2"]}]},{"id":"PYSEC-2026-2467","url":"https://osv.dev/vulnerability/PYSEC-2026-2467","summary":"python-ecdsa: Denial of Service via improper DER length validation in crafted private keys","modified":"2026-07-13T16:31:45.568903235Z","packages":[{"ecosystem":"PyPI","name":"ecdsa","purl":"pkg:pypi/ecdsa","ranges":["<0.19.2"],"fixed":["0.19.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}