PT-2026-23915 · Dropbear · Dropbear

Pythok · Published 2026-03-08 · Updated 2026-03-08 · CVE-2026-3706

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dropbear versions up to 2025.89

Description A flaw exists in mkj Dropbear that relates to improper verification of cryptographic signatures. This issue stems from a manipulation within the unpackneg function located in the src/curve25519.c file, specifically within the S Range Check component. The attack can be initiated remotely and is considered to have high complexity, with difficult exploitability. The exploit has been publicly disclosed. The issue undermines integrity and auditing of Ed25519 signatures, allowing crafted signatures to be accepted.

Recommendations Deploy the patch fdec3c90a15447bd538641d85e5a3e3ac981011d.

Exploit

Fix

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

CVE-2026-3706

Affected Products

Dropbear

References · 20

• 🔥 https://github.com/mkj/dropbear/issues/406 · Exploit
• 🔥 https://github.com/mkj/dropbear/issues/406#issue-3978907798 · Exploit
• https://github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d · Patch
• https://github.com/mkj/dropbear/pull/407 · Patch
• https://osv.dev/vulnerability/CVE-2026-3706 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3706 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3706 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3706 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3706 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3706 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3706 · Security Note
• https://github.com/str4d/ed25519-java/issues/82#issue-727629226 · Note
• https://twitter.com/VolerionSec/status/2030513973066399996 · Twitter Post
• https://vuldb.com/?submit.765933 · Note
• https://vuldb.com/?id.349652 · Note