Vulnerability in Mkj Dropbear
CVE-2026-3706
A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The at…
EPSS: 0.000 (0.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C.
Affected products
- Mkj Dropbear — versions 2025.0, 2025.1, 2025.2
Weakness classification (CWE)
References
- VDB-349652 | mkj Dropbear S Range Check curve25519.c unpackneg signature verification (vdb-entry, technical-description)
- VDB-349652 | CTI Indicators (IOB, IOC, IOA) (signature, permissions-required)
- Submit #765933 | GitHub Dropbear 2025.89 Improper Verification of Cryptographic Signature (third-party-advisory)
- github.com/mkj/dropbear/issues/406 (issue-tracking)
- github.com/mkj/dropbear/pull/407 (issue-tracking, patch)
- github.com/mkj/dropbear/commit/fdec3c90a15447bd538641d85e5a3e3ac981011d (patch)
- github.com/str4d/ed25519-java/issues/82 (issue-tracking)
- github.com/mkj/dropbear/ (product)
Frequently asked questions
- What is CVE-2026-3706?
- CVE-2026-3706 is a low-severity vulnerability in Mkj Dropbear, classified under Improper Verification of Cryptographic Signature. CVSS score: 3.7/10. Published 2026-03-08.
- How severe is CVE-2026-3706?
- Low severity. CVSS v3 base score is 3.7 out of 10.