CVE-2026-26007
Vulnerability Title: Small Subgroup Attack due to Missing Subgroup Validation in Python cryptography Library
Affected Component: cryptography (Python package)
Affected Versions: ≤ 46.0.4
Fixed Version: 46.0.5 and later
CVSS Score: 8.2 (High)
Severity: High
Attack Vector: Network
Privileges Required: None
User Interaction: None
Exploitability: High when untrusted public keys are accepted
Exploit Availability: No widely distributed public weaponized exploit; academic-level proof techniques exist
Official Patch / Upgrade Link:
https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
Overview
A cryptographic validation weakness was identified in the Python cryptography library where subgroup membership validation was not properly enforced for certain elliptic curves, specifically binary curves (SECT curves) with a cofactor greater than one.
Improper validation allowed specially crafted elliptic curve public keys to be accepted without ensuring that the point belonged to the correct prime-order subgroup. In cryptographic systems using ECDH or ECDSA, this missing validation could enable a Small Subgroup Attack, potentially resulting in partial private key leakage or signature forgery under certain conditions.
The issue was corrected in version 46.0.5 by implementing strict subgroup validation during public key construction and deserialization.
Technical Description
Elliptic curve cryptography relies on operations within a large prime-order subgroup. Some curves, particularly SECT (binary) curves, contain small subgroups due to having a cofactor greater than one.
When a public key is received, proper validation must confirm:
- The point lies on the curve.
- The point is not at infinity.
- The point belongs to the correct prime-order subgroup.
In vulnerable versions, subgroup validation was not enforced in specific key-loading and construction APIs:
EllipticCurvePublicNumbers.public_key()load_der_public_key()load_pem_public_key()
As a result, attacker-supplied points from small subgroups could be accepted and used in cryptographic operations.
When ECDH computations are performed using such a malicious point:
Shared Secret = d × P
If P belongs to a small subgroup, the resulting shared secret reveals information about:
d mod r
Where:
- d = private key
- r = small subgroup order
By repeating interactions with carefully chosen subgroup elements, portions of the private key can be inferred.
Root Cause
The vulnerability was caused by insufficient verification of subgroup membership for elliptic curve public keys when:
- Constructed programmatically from coordinates.
- Loaded from PEM/DER encoded inputs.
Cofactor handling and subgroup validation logic were incomplete for SECT curves.
This resulted in an instance of:
CWE-345: Insufficient Verification of Data Authenticity
Impact Assessment
The following impacts were considered realistic in affected deployments:
Private Key Leakage
Repeated ECDH interactions with malicious public keys could allow recovery of portions of a victim’s private key.
Signature Forgery
If signature verification was performed against attacker-controlled subgroup elements, forged signatures may be accepted under specific conditions.
Protocol Weakening
Applications performing:
- TLS handshakes
- Token verification
- API request signing
- Custom ECDH-based protocols
may have been exposed if untrusted public keys were accepted.
Multi-Tenant or Cloud Risk
Services accepting client-provided public keys in high-frequency operations were considered higher risk due to repeated interaction opportunities.
Attack Scenario
The following scenario was considered feasible:
- An application exposes an endpoint accepting client public keys.
- The public key is loaded using vulnerable API functions.
- The key is used in ECDH for session derivation.
- The attacker sends multiple crafted subgroup points.
- Observations of resulting behavior (errors, timing, derived secrets, protocol output) allow inference of private key bits.
No authentication was required if public key submission was allowed anonymously.
Exploitation Details (Educational)
The attack relies on:
- Selecting elliptic curve points of small order.
- Submitting these points as valid public keys.
- Forcing cryptographic operations.
- Observing derived outputs.
Indicators of attempted exploitation include:
- Repeated submissions of public keys using SECT curves.
- High-frequency ECDH computations.
- Unexpected binary curve usage.
- Abnormal key parsing patterns.
There is no publicly released automated exploit toolkit at the time of writing. However, academic methods for small subgroup attacks are well documented in cryptographic research.
Detection Strategy
Detection must focus on cryptographic telemetry and behavioral anomalies.
1. Log Sources to Monitor
- Application logs (key parsing events)
- TLS handshake logs
- API gateway logs
- Reverse proxy logs
- HSM or key management service logs
- ECDH operation audit trails
- Container runtime logs (if cryptographic services run in containers)
2. Indicators of Suspicious Activity
- Use of SECT curve OIDs in environments where only prime curves are expected.
- Multiple ECDH operations from same IP within short time.
- Public key parsing failures with unusual coordinates.
- Repeated signature verifications with unfamiliar keys.
- High volume of small key exchange requests.
Detection Rules
Detect SECT Curve Usage
index=app_logs event_type=public_key_loaded
| search curve_name="sect*" OR curve_oid="1.3.132.*"
| stats count by src_ip, curve_name
| where count > 0
Excessive ECDH Operations
index=app_logs event_type=ecdh_compute
| stats count by src_ip, key_id span=10m
| where count > 15
Binary Curve Detection
event.category:"crypto" AND
(public_key.curve: "sect*" OR public_key.oid: "1.3.132.*")
Microsoft Sentinel
AppLogs
| where EventType == "ECDH_Compute"
| summarize count() by SrcIP, bin(TimeGenerated, 10m)
| where count_ > 15
EDR Behavioral Detection
Trigger alert if:
- cryptography library loads SECT curve.
- Process performs repeated EC scalar multiplications.
- Abnormal CPU spike correlated with repeated handshake attempts.
Forensic Investigation Guidance
If exploitation is suspected:
- Identify timeframe of exposure.
- Determine whether SECT curves were used.
- Audit frequency of ECDH operations.
- Review API endpoints accepting public keys.
- Rotate all affected private keys.
- Reissue certificates if required.
- Revalidate cryptographic parameters in configuration.
Full compromise confirmation is difficult because subgroup attacks do not necessarily leave obvious traces.
Mitigation
Immediate Actions
- Upgrade cryptography to version 46.0.5 or later.
- Redeploy services with patched dependency.
- Rebuild containers and virtual environments.
- Re-scan dependency tree.
Hardening Recommendations
- Reject SECT curves unless explicitly required.
- Restrict accepted curves to prime-order curves (e.g., secp256r1).
- Validate curve OID before performing cryptographic operations.
- Implement rate limiting on key exchange endpoints.
- Monitor cryptographic error logs aggressively.
Verification of Patch
After upgrading:
- Attempt loading malformed subgroup points (in controlled lab).
- Confirm exceptions are raised.
- Ensure no SECT curve usage unless explicitly allowed.
- Validate dependency version using:
pip show cryptography
Ensure version ≥ 46.0.5.
MITRE ATT&CK Mapping
While this is a cryptographic implementation flaw rather than a direct intrusion technique, it aligns operationally with:
- Credential Access (private key extraction)
- Defense Evasion (subtle cryptographic manipulation)
- Impact (signature forgery or trust bypass)
Risk Rating Summary
| Factor | Rating |
|---|---|
| Confidentiality | High |
| Integrity | High |
| Availability | Low |
| Attack Complexity | Moderate |
| Network Exploitable | Yes |
| Authentication Required | No |
Final Takeaway
CVE-2026-26007 represents a serious cryptographic validation flaw that may allow private key leakage through small subgroup manipulation. The issue affects deployments accepting untrusted elliptic curve public keys, particularly those using SECT curves.
While exploitation requires cryptographic knowledge, environments performing repeated ECDH operations with external inputs are considered at elevated risk.
Upgrading to version 46.0.5 or later fully resolves the issue by enforcing strict subgroup validation.
