CVE-2026-3706

Description

A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch.

PUBLISHED Reserved 2026-03-07 | Published 2026-03-08 | Updated 2026-03-08 | Assigner VulDB

Problem types

Improper Verification of Cryptographic Signature

Insufficient Verification of Data Authenticity

Product status

Timeline

Credits

pythok (VulDB User) reporter

References

vuldb.com/?id.349652 (VDB-349652 | mkj Dropbear S Range Check curve25519.c unpackneg signature verification) vdb-entry technical-description

vuldb.com/?ctiid.349652 (VDB-349652 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.765933 (Submit #765933 | GitHub Dropbear 2025.89 Improper Verification of Cryptographic Signature) third-party-advisory

github.com/str4d/ed25519-java/issues/82 issue-tracking

github.com/mkj/dropbear/pull/407 issue-tracking patch

github.com/mkj/dropbear/issues/406 exploit issue-tracking

github.com/...ommit/fdec3c90a15447bd538641d85e5a3e3ac981011d patch

github.com/mkj/dropbear/ product

cve.org (CVE-2026-3706)

nvd.nist.gov (CVE-2026-3706)

Download JSON