{"schema_version":"1.7.2","id":"OESA-2026-1838","modified":"2026-04-11T14:03:21Z","published":"2026-04-11T14:03:21Z","upstream":["CVE-2026-33936"],"summary":"python-ecdsa security update","details":"This is an easy-to-use implementation of ECDSA cryptography (Elliptic Curve Digital Signature Algorithm), implemented purely in Python, released under  the MIT license. With this library, you can quickly create keypairs (signing  key and verifying key), sign messages, and verify the signatures. The keys  and signatures are very short, making them easy to handle and incorporate  into other protocols.\r\n\r\nSecurity Fix(es):\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is parsed successfully instead of being rejected. Because of that, a crafted DER input can cause `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`) rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service. Version 0.19.2 patches the issue.(CVE-2026-33936)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS","name":"python-ecdsa","purl":"pkg:rpm/openEuler/python-ecdsa&distro=openEuler-24.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-3.oe2403"}]}],"ecosystem_specific":{"noarch":["python-ecdsa-help-0.18.0-3.oe2403.noarch.rpm","python3-ecdsa-0.18.0-3.oe2403.noarch.rpm"],"src":["python-ecdsa-0.18.0-3.oe2403.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1838"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33936"}],"database_specific":{"severity":"Medium"}}