CVE catalog

CVE-2026-3706

Severity: Medium · CVSS 6.3
Published: Mar 8, 2026, 5:16:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 22, 2026

A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch. The project maintainer explains: "Signature Malleability is not exploitable in SSH protocol. (...) [A] PoC doesn't exist for SSH implementation, but rather it's against the internal API."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	dropbear	sid	`2026.94-1`	fixed
Debian	dropbear	forky	`2026.94-1`	fixed
Debian	dropbear	trixie	`2025.89-1~deb13u1`	vulnerable
Debian	dropbear	trixie-security	`2025.89-1~deb13u1`	vulnerable
Debian	dropbear	bookworm	`2022.83-1+deb12u3`	vulnerable
Cpe	dropbear	Not reported	Not reported	vulnerable
Ubuntu	dropbear	16.04	`2014.65-1ubuntu2`	vulnerable
Ubuntu	dropbear	16.04	`2015.68-1`	vulnerable
Ubuntu	dropbear	16.04	`2015.70-1`	vulnerable
Ubuntu	dropbear	16.04	`2015.71-1`	vulnerable
Ubuntu	dropbear	16.04	`2016.72-1`	vulnerable
Ubuntu	dropbear	pro	`2019.78-2build1`	vulnerable
Ubuntu	dropbear	pro	`2019.78-2ubuntu0.1~esm1`	vulnerable
Ubuntu	dropbear	22.04	`2020.81-3`	vulnerable
Ubuntu	dropbear	22.04	`2020.81-4`	vulnerable
Ubuntu	dropbear	22.04	`2020.81-5`	vulnerable
Ubuntu	dropbear	22.04	`2020.81-5ubuntu0.1`	vulnerable
Ubuntu	dropbear	24.04	`2022.83-2`	vulnerable
Ubuntu	dropbear	24.04	`2022.83-3`	vulnerable
Ubuntu	dropbear	24.04	`2022.83-4`	vulnerable
Ubuntu	dropbear	25.10	`2024.86-2`	vulnerable
Ubuntu	dropbear	25.10	`2025.88-2`	vulnerable
Ubuntu	dropbear	26.10	`2025.89-1`	vulnerable
Ubuntu	dropbear	26.10	`2026.91-1`	vulnerable
Ubuntu	dropbear	26.10	`2026.92-1`	vulnerable
Ubuntu	dropbear	26.10	`2026.94-1`	vulnerable
Ubuntu	dropbear	26.10	`2026.94-1ubuntu1`	vulnerable
Ubuntu	dropbear	26.04	`2025.88-2`	vulnerable
Ubuntu	dropbear	26.04	`2025.89-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	dropbear	source	sid	`2026.90-1`	unimportant	Not reported	[1130870]
Debian	dropbear	source	forky	`2026.90-1`	unimportant	Not reported	[1130870]
Debian	dropbear	source	trixie	`(unfixed)`	unimportant	Not reported	[1130870]
Debian	dropbear	source	bookworm	`(unfixed)`	unimportant	Not reported	[1130870]

[Debian bug #1130870]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[dropbear]Unknown
Details (2)
- 2022.83-1+deb12u3 · all · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
- 2022.83-1+deb12u3 · all · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
[dropbear-bin]Unknown
Source package: [dropbear]
Details (2)
- 2022.83-1+deb12u3 · amd64 · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
- 2022.83-1+deb12u3 · arm64 · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
[dropbear-initramfs]Unknown
Source package: [dropbear]
Details (2)
- 2022.83-1+deb12u3 · all · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
- 2022.83-1+deb12u3 · all · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
[dropbear-run]Unknown
Source package: [dropbear]
Details (2)
- 2022.83-1+deb12u3 · all · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12
- 2022.83-1+deb12u3 · all · bookworm
  Affected
  nvd · dropbear · debian · bookworm; nvd · dropbear · debian · 12

[Debian 13 (Trixie)]

[dropbear]Unknown
Details (4)
- 2025.89-1~deb13u1 · all · trixie
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · all · trixie
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · all · trixie-security
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · all · trixie-security
  Affected
  nvd · dropbear · debian · 13
[dropbear-bin]Unknown
Source package: [dropbear]
Details (4)
- 2025.89-1~deb13u1 · amd64 · trixie
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · arm64 · trixie
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · amd64 · trixie-security
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · arm64 · trixie-security
  Affected
  nvd · dropbear · debian · 13
[dropbear-initramfs]Unknown
Source package: [dropbear]
Details (4)
- 2025.89-1~deb13u1 · all · trixie
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · all · trixie
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · all · trixie-security
  Affected
  nvd · dropbear · debian · 13
- 2025.89-1~deb13u1 · all · trixie-security
  Affected
  nvd · dropbear · debian · 13

Observed: Oct 24, 2026, 12:37:34 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]