Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paragonie/ecc | composer | >= 0, < 2.0.1 | 2.0.1 |
| mdanter/ecc | composer | <= 1.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from non-constant-time comparisons in point addition operations. The original implementation used conditional branches to check if points were identical (requiring doubling) or additive inverses (returning infinity), creating measurable timing differences. The paragonie/phpecc release notes explicitly reference fixing a branch-based timing leak in point addition, and their mitigation involved replacing the conditional logic with constant-time operations. While other functions (mul(), getDouble()) were mentioned in context of side-channel fixes, the CVE specifically identifies point addition as the vulnerable operation based on the pseudocode example and vulnerability description.
