{"id":"CVE-2026-63410","kind":"vulnerability","aliases":["CVE-2026-63410"],"related":[],"title":"secp256k1-native Ruby gem: timing leak can expose secret scalars in native builds","description":"secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The `Montgomery ladder` uses `uint256_select` with an all-zeros or all-ones mask, but affected GCC builds at `-O2` recover the original condition and emit secret-dependent `je` or `jne` jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 `jp_add_internal` infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or `ctgrind` on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and `extconf.rb` appends `-O2`. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time `cmov`; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. `Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom.` Version 0.18.0 contains the verified fix. The advisory's broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved.","summary":"The secp256k1-native Ruby gem's constant-time scalar multiplication can be compiled by some GCC versions into secret-dependent branches, so timing measurements can leak secret key or nonce bits. An attacker who can observe timing of repeated multiplications with a secret scalar may statistically recover scalar bits.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cryptography","gcc","package","ruby","secp256k1-native"],"not_affected_if":["no-secret-scalar-multiplication","pure-ruby-path","timing-not-observable"],"how_to_check":"- Check the installed gem version with `gem list secp256k1-native`; versions before `0.18.0` are in scope per the description\n- Confirm whether the gem uses the native build (not pure Ruby) and which GCC compiled it, for example with `gcc --version`, since GCC 14.3.0, 15.1.0 and 15.2.0 reproduced the issue\n- Identify whether any code path multiplies a secret private key or nonce via `Point#mul` or `scalar_multiply_ct` where timing may be observable","fix":"- `secp256k1-native` `0.18.0`, which contains the verified fix per the description","status":"open","published_at":"2026-10-30T23:17:15+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","triaged_at":"2026-10-30T23:28:11+00:00","updated_at":"2026-10-30T23:28:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T23:28:11Z","model":"claude-haiku-5-5","output":{"fix":"- `secp256k1-native` `0.18.0`, which contains the verified fix per the description","reach":"unknown","title":"secp256k1-native Ruby gem: timing leak can expose secret scalars in native builds","impact":"medium","summary":"The secp256k1-native Ruby gem's constant-time scalar multiplication can be compiled by some GCC versions into secret-dependent branches, so timing measurements can leak secret key or nonce bits. An attacker who can observe timing of repeated multiplications with a secret scalar may statistically recover scalar bits.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","secp256k1-native","gcc","cryptography"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"secret scalar bits recovered through timing measurements over repeated operations","analyst_note":"Confirm the exact scope of the fix: whether 0.18.0 covers only the 0.17.0 select idiom or also earlier pre-0.17.0 constant-time issues, as the description leaves this unresolved; check the NVD entry and advisory for affected version ranges.","how_to_check":"- Check the installed gem version with `gem list secp256k1-native`; versions before `0.18.0` are in scope per the description\n- Confirm whether the gem uses the native build (not pure Ruby) and which GCC compiled it, for example with `gcc --version`, since GCC 14.3.0, 15.1.0 and 15.2.0 reproduced the issue\n- Identify whether any code path multiplies a secret private key or nonce via `Point#mul` or `scalar_multiply_ct` where timing may be observable","plain_action":"","needs_analyst":true,"not_affected_if":["pure-ruby-path","no-secret-scalar-multiplication","timing-not-observable"],"who_is_affected":"Only applications that use the native build of secp256k1-native and multiply a secret private key or nonce where an attacker can observe timing. The pure-Ruby path is not affected by this flaw according to the description. Whether the advisory's pre-0.18.0 guidance also covers older, different constant-time issues remains unresolved in the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000857,"input_tokens":4626,"output_tokens":788,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63410':17A,20A '0.17.0':175C,297C,345C '0.18.0':312C,322C '12.4.0':247C '13.3.0':253C '14.3.0':231C '15.1.0':232C '15.2.0':234C '16':279C 'add':177C 'advisori':318C 'affect':92C,145C,266C 'all-on':140C 'all-zero':136C 'also':324C 'append':241C 'assumpt':172C 'attack':63B,198C 'behind':173C 'binari':215C 'bisect':294C 'bit':61B,79B,168C,208C 'bitwis':249C 'branch':51B,127C,181C,237C 'branchless':123C 'broad':320C 'build':14A,94C,147C 'c':86C 'claim':277C 'clang':281C 'cmov':258C 'combin':290C 'compil':42B,117C,214C 'condit':153C 'constant':36B,97C,256C,275C,302C,329C 'constant-tim':35B,96C,255C,274C,301C,328C 'consum':184C 'contain':313C 'context':195C 'correl':165C 'cover':325C 'cryptographi':21B 'ct':107C 'ctgrind':220C 'cve':15A,18A,334C 'defeat':170C 'defect':210C 'depend':50B,158C 'differ':300C,327C 'earlier':295C,326C 'emit':155C 'exhaust':293C 'expos':9A 'extconf.rb':240C 'fix':182C,316C 'flag':289C 'flaw':269C 'gcc':22B,45B,146C,230C,244C,252C,278C 'gem':5A,33B 'group':335C 'guidanc':323C 'idiom':310C,342C 'implement':88C 'infin':180C 'infinity-branch':179C 'inform':111C 'intern':178C 'introduc':308C,343C 'issu':304C,331C,337C 'je':159C 'jne':161C 'jp':176C 'jump':162C 'key':58B,190C 'ladder':130C 'leak':7A,56B,109C 'make':272C 'mask':143C 'may':75B,227C 'measur':54B,203C 'miss':228C 'montgomeri':129C 'mul':103C 'multipl':39B,70B,100C 'multipli':106C,186C 'must':185C 'nativ':3A,13A,27B,31B,82C,85C,93C,95C 'non':224C 'non-reconstruct':223C 'nonc':60B,192C 'o2':149C,242C 'observ':66B,200C 'one':142C 'oper':250C 'origin':152C 'packag':23B 'path':263C 'point':102C,285C 'pre':296C,321C 'privat':189C 'pure':261C 'pure-rubi':260C 'rather':305C 'reconstruct':122C,225C,238C 'recov':77B,150C,206C 'releas':286C 'remain':346C 'repeat':69B,202C 'reproduc':235C 'review':218C 'rubi':4A,24B,32B,90C,262C 'scalar':11A,38B,74B,78B,99C,105C,115C,167C,207C 'secp256k1':2A,26B,30B,81C,87C 'secp256k1-native':1A,25B,29B,80C 'secret':10A,49B,57B,73B,114C,157C,188C 'secret-depend':48B,156C 'select':124C,133C,309C,341C 'separ':271C 'sourc':217C 'statist':76B,205C 'target':287C 'test':243C 'time':6A,37B,53B,67B,98C,110C,164C,201C,257C,276C,303C,330C 'toolchain':120C,226C 'uint256':132C 'unresolv':347C 'untest':283C 'use':131C,248C,254C 'verifi':315C 'version':46B,245C,298C,311C 'whether':332C 'whose':163C 'zero':138C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the native build of secp256k1-native and multiply a secret private key or nonce where an attacker can observe timing. The pure-Ruby path is not affected by this flaw according to the description. Whether the advisory's pre-0.18.0 guidance also covers older, different constant-time issues remains unresolved in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T23:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63410","severity":null,"published_at":"2026-10-30T23:17:15+00:00","modified_at":"2026-10-30T23:17:15+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","fetched_at":"2026-10-30T23:26:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}