JLSEC-2026-216

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-216.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-216.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2026-216
Upstream
  • EUVD-2019-10108
  • GHSA-fcc6-m5v9-xcgq
Published
2026-04-27T18:33:55.942Z
Modified
2026-04-27T20:32:28.639045907Z
Summary
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with...
Details

There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BNmodexp may be affected if they use BNFLG_CONSTTIME. Fixed in OpenSSL 1.1.1e-dev (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u-dev (Affected 1.0.2-1.0.2t).

Database specific 
{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1551",
            "database_specific": {
                "status": "Modified"
            },
            "modified": "2024-11-21T04:36:48.500Z",
            "id": "CVE-2019-1551",
            "published": "2019-12-06T18:15:12.840Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-1551",
            "imported": "2026-04-27T16:32:26.629Z"
        },
        {
            "html_url": "https://github.com/advisories/GHSA-fcc6-m5v9-xcgq",
            "modified": "2024-04-04T02:42:08Z",
            "id": "GHSA-fcc6-m5v9-xcgq",
            "published": "2022-05-24T17:02:47Z",
            "url": "https://api.github.com/advisories/GHSA-fcc6-m5v9-xcgq",
            "imported": "2026-04-27T16:35:06.812Z"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10108",
            "modified": "2024-09-16T19:40:14Z",
            "id": "EUVD-2019-10108",
            "published": "2019-12-06T17:20:14Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2019-10108",
            "imported": "2026-04-27T16:33:25.976Z"
        }
    ],
    "license": "CC-BY-4.0"
}
References

Affected packages

Julia / OpenSSL_jll

Package

Name
OpenSSL_jll
Purl
pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1+2

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-216.json"

Julia / Openresty_jll

Package

Name
Openresty_jll
Purl
pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.19.9+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-216.json"