CVE-2026-33936: python-ecdsa Denial of Service via Improper DER Length Validation
Summary
CVE-2026-33936: python-ecdsa: Denial of Service via improper DER length validation in crafted private keys. Affects ecdsa versions < 0.19.2. Fixed in 0.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-ecdsa package is a popular library for Elliptic Curve Digital Signature Algorithm (ECDSA) in Python, enabling secure digital signatures. It is widely used in cryptographic applications due to its efficiency and security features. However, it has a vulnerability related to improper validation of DER (Distinguished Encoding Rules) lengths in private keys, which can lead to denial of service when parsing untrusted input.
Vulnerability Detail
The vulnerability arises from the low-level DER parsing functions in the python-ecdsa library. Specifically, the function 'ecdsa.der.remove_octet_string()' incorrectly accepts truncated DER inputs where the declared length exceeds the actual buffer size. This flaw allows crafted DER inputs to cause 'SigningKey.from_der()' to raise unexpected exceptions, such as 'IndexError', instead of properly rejecting malformed DER. As a result, applications that do not handle these exceptions may crash, leading to a denial of service. The lack of bounds checks in DER helper functions exacerbates the issue, allowing malformed DER to be accepted.
How To Fix
Latest published version: 0.19.2 as of 23 Oct 2026
pip install --upgrade "ecdsa==0.19.2"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version of the package.
Conclusion
The python-ecdsa package has a vulnerability (CVE-2026-33936) that can lead to denial of service due to improper DER length validation. It is crucial to update to the latest version to mitigate this risk and ensure the security of applications using this library.
See every vulnerability recorded for ecdsa →
FAQ
CVE-2026-33936 is a vulnerability in the python-ecdsa package that allows for denial of service due to improper DER length validation in crafted private keys.
Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. The Vulert playground allows you to check if your application is affected without requiring access to the code or installation.
Update the python-ecdsa package to version 0.19.2 or later using the command 'pip install --upgrade ecdsa'. This will ensure that the vulnerability is patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for ecdsa.
