Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
ed25519-dalek Crate Allows Private Key Exposure
published 1 year ago
Summary
A security flaw in the ed25519-dalek library for Rust makes it possible for attackers to access private keys. This could allow unauthorized access to sensitive data. Update the ed25519-dalek crate to version 2 or later to fix the issue.
What to do
- Update isislovecruft ed25519-dalek to version 2.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | isislovecruft | ed25519-dalek |
< 2.0.0 Fix: upgrade to 2.0.0
|
Original advisory text
Duplicate Advisory: `ed25519-dalek` Double Public Key Signing Function Oracle Attack
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w5vr-6qhr-36cc. This link is maintained to preserve external references.
### Original Description
The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
This advisory has been withdrawn because it is a duplicate of GHSA-w5vr-6qhr-36cc. This link is maintained to preserve external references.
### Original Description
The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere
Timeline
Published28 Jul 2025
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-g693-v3jr-8hcr · GHSA
Track software like this
Free during beta