PT-2026-28568 · Pypi · Ecdsa

0Xmrma · CVE-2026-33936 · Published 2026-03-27 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ecdsa versions prior to 0.19.2

Description The ecdsa package, a Python implementation of ECC, contains a flaw in its DER parsing functions. Specifically, ecdsa.der.remove octet string() incorrectly accepts truncated DER data where the declared length exceeds the actual buffer size. This can lead to SigningKey.from der() raising an internal IndexError instead of a clean rejection of malformed DER, potentially causing a denial of service when parsing untrusted DER private keys. A crafted DER input can trigger this issue.

Recommendations Upgrade to ecdsa version 0.19.2 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-130

CWE-20

Related Identifiers

CLEANSTART-2026-CQ05396

CLEANSTART-2026-SO50412

CVE-2026-33936

ECHO-DC11-DAA6-FC93

GHSA-9F5J-8JWJ-X28G

OESA-2026-1836

OESA-2026-1837

OESA-2026-1838

OESA-2026-1839

OPENSUSE-SU-2026:10468-1

OPENSUSE-SU-2026:21078-1

PYSEC-2026-2467

SUSE-SU-2026:1436-1

SUSE-SU-2026:1608-1

SUSE-SU-2026:22158-1

Affected Products

Ecdsa

References · 122

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33936.json · Exploit
• https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-9f5j-8jwj-x28g · Vendor Advisory
• https://github.com/tlsfuzzer/python-ecdsa/commit/bd66899550d7185939bf27b75713a2ac9325a9d3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42561 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44307 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2467 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9f5j-8jwj-x28g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-CQ05396 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-SO50412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31958 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48525 · Security Note