CVE-2026-1229: Wrong P-384 Result in Cloudflare CIRCL

CVE-2026-1229 is a critical arithmetic bug (CVSS 9.8 in the CVE record) in the Cloudflare CIRCL Go library. The CombinedMult function in the ecc/p384 package returns an incorrect value for specific inputs. It is fixed in v1.6.3. Upgrade github.com/cloudflare/circl and check where your code uses the P-384 package.

What's affected

From the CVE record and the v1.6.3 release page:

• Product: Cloudflare CIRCL, the Go module github.com/cloudflare/circl.
• Component: the ecc/p384 package (the secp384r1 curve), function CombinedMult.
• Fixed version: v1.6.3. The record does not state the lowest affected version, so treat releases before v1.6.3 as in scope.
• Not affected, per the record: ECDH and ECDSA signing that rely on this curve.
• Weakness class: CWE-682 (incorrect calculation).
• The fix: the record says it uses complete addition formulas. The release notes say "Fix a bug on ecc/p384 scalar multiplication" and list the change "Point addition must handle point doubling case".
• Release date: the v1.6.3 release page shows 22 January, and the CVE was published on 24 February 2026.

How to check if you're exposed

CIRCL is a Go module, so you can find it in go.mod and in built binaries.

go list -m github.com/cloudflare/circl
go mod why -m github.com/cloudflare/circl

The first command prints the version your module uses. The second shows which of your packages pull it in. For compiled binaries, read the module list that Go embeds:

go version -m ./your-binary | grep circl

You can also paste go.mod or go.sum into the free scan at gold.safeguard.sh/scan. Then search your code for ecc/p384 and CombinedMult to see whether the vulnerable function is called, directly or through another library.

What to do now

1. Upgrade the module in every Go project that uses it.

go get github.com/cloudflare/circl@v1.6.3
go mod tidy

2. Rebuild and redeploy every binary that includes the module. Updating go.mod alone does not change a binary you already shipped.
3. Search your code and your dependencies for CombinedMult and for other uses of the ecc/p384 package, and note what they are used for.
4. Run your test suite, including any cryptographic tests, after the upgrade.
5. Check vendored copies, forks and container images that carry their own copy of the library.

Why it matters

This is a bug in the math, not in a protocol. An elliptic curve library adds and multiplies points. The addition formulas used by the earlier code did not handle every case, and the record says the fix is to use complete addition formulas, which are formulas that work for every pair of inputs. The release notes name the missed case: adding a point to itself, which is point doubling. For those specific inputs the function returned the wrong value.

A wrong value in cryptographic code can matter even if nothing crashes. The record rates the impact as High across confidentiality, integrity and availability. The record also says that ECDH and ECDSA signing relying on this curve are not affected, which narrows the problem. It names only those two operations, so review other uses of the package, including any verification or custom protocols that call CombinedMult, and upgrade without waiting for that review.

Fixing is cheap here: a version bump of one module. The harder part is finding everything that carries it, which is what a dependency inventory is for. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the record does not describe exploitation.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry and CVE record: CVE-2026-1229.
• CIRCL v1.6.3 release, with the fix to ecc/p384 scalar multiplication.
• CIRCL repository, the project reference listed in the record.

Last reviewed: 19 October 2026.