{"id":"CVE-2022-50237","aliases":["RUSTSEC-2022-0093"],"url":"https://o3.security/vulnerability/CVE-2022-50237","summary":"`ed25519-dalek` Double Public Key Signing Function Oracle Attack","details":"Versions of `ed25519-dalek` prior to v2.0 model private and public keys as separate types which can be assembled into a `Keypair`, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.\n\nSuch APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the `S` part of the signature, but not in the `R` value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same `R` and only differ on the `S` part.\n\nUnfortunately, when this happens, one can easily extract the private key.\n\nRevised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled \"hazmat\" APIs which are clearly labeled as being dangerous if misused.","published":"2023-08-14T21:10:29Z","modified":"2026-02-04T03:12:24.206854Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":{"score":0.00183,"percentile":0.08134,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"ed25519-dalek","fixedVersion":"2.0.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50237"},{"type":"WEB","url":"https://github.com/MystenLabs/ed25519-unsafe-libs"},{"type":"PACKAGE","url":"https://github.com/dalek-cryptography/ed25519-dalek"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0093.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-04T03:12:24.206854Z"}}