Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generation
A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst_sha256_bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation functions, such as blst_keygen_v5(), if the application exposes this functionality. Successful exploitation leads to memory corruption and immediate process termination, resulting in a denial-of-service (DoS) condition.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-787 | Out-of-bounds Write |
Type: CWE
Description: Out-of-bounds Write
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Metrics Other Info
Red Hat severity rating
namespace:
https://access.redhat.com/security/updates/classification/
Timeline
| Event | Date |
|---|
| Reported to Red Hat. | 2026-02-18 12:22:01 |
| Made public. | 2026-02-18 00:00:00 |
Event: Reported to Red Hat.
Date: 2026-02-18 12:22:01
Event: Made public.
Date: 2026-02-18 00:00:00