1 issue left for the package maintainer to handle:
CVE-2025-8556:
(needs triaging)
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
Among the 1 debian patch
available in version 1.6.4-2 of the package,
we noticed the following issues:
1 patch
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-github-cloudflare-circl.png){kind=link}