CVE-2026-87737

The mirage-crypto-ec package prior to version 2.4.0 for OCaml is vulnerable to a timing side channel attack during NIST elliptic-curve scalar multiplication, where the time taken for a lookup may reveal secret information. This could potentially allow an attacker to exploit the timing variations to recover sensitive cryptographic keys. Organizations using this package should prioritize upgrading to version 2.4.0 or later to mitigate the risk of key exposure.