https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T19:10:52.316347+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-261904 EUVD-2026-261904 2026-10-07T19:10:52.338954+00:00 EUVD-2026-261904 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66016 fkie_cve-2025-66016 2026-10-07T19:10:52.339006+00:00

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key. This issue has been patched in version 0.6.3, for full mitigation it is recommended to upgrade to cggmp24 version 0.7.0-alpha.2 as it contains more security checks.

 https://cve.radiocsirt.org/vuln/ghsa-m95p-425x-x889 GHSA-m95p-425x-x889 — cggmp21 has a missing check in the ZK proof used in CGGMP21 2026-10-07T19:10:52.339059+00:00

Affected: crates.io: cggmp21, crates.io: cggmp24

### Impact cggmp21 concerns a missing check in the ZK proof that enables an attack in which a single malicious signer can reconstruct full private key.

### Patches * `cggmp21 v0.6.3` is a patch release that contains a fix that introduces this specific missing check * However, cggmp21 recommends upgrading to `cggmp24 v0.7.0-alpha.2` which contains many other security checks as a precaution. Follow [migration guideline](https://github.com/LFDT-Lockness/cggmp21/blob/v0.7.0-alpha.2/CGGMP21_MIGRATION.md) to upgrade.

### Workarounds Update to `cggmp21 v0.6.3`, a minor release that contains a minimal security patch.

However, for full mitigation, users will need to upgrade to `cggmp24 v0.7.0-alpha.2` as it contains many more security check implementations.

### Resources Read this [blog post](https://www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained) to learn more.

 https://cve.radiocsirt.org/vuln/rustsec-2025-0129 RUSTSEC-2025-0129 — Missing check in ZK proof in CGGMP21 Threshold Signing Protocol 2026-10-07T19:10:52.339121+00:00

Affected: crates.io: cggmp21

Vulnerability concerns a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key.

### Patches * `cggmp21 v0.6.3` is a patch release that contains a fix that introduces this specific missing check. * However, we recommend upgrading to `cggmp24 v0.7.0-alpha.2` in which we've introduced many other security checks as a precaution. Follow the [migration guidelines](https://github.com/LFDT-Lockness/cggmp21/blob/v0.7.0-alpha.2/CGGMP21_MIGRATION.md) to upgrade.

### References Read our [blog post](https://www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained) to learn more.