---
id: "CVE-2026-63410"
kind: "vulnerability"
aliases: ["CVE-2026-63410"]
title: "secp256k1-native Ruby gem: timing leak can expose secret scalars in native builds"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cryptography", "gcc", "package", "ruby", "secp256k1-native"]
not_affected_if: ["no-secret-scalar-multiplication", "pure-ruby-path", "timing-not-observable"]
published_at: "2026-10-30T23:17:15+00:00"
first_seen_at: "2026-10-30T23:26:12+00:00"
updated_at: "2026-10-30T23:28:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63410", "first_seen_at": "2026-10-30T23:26:12+00:00"}]
---

# secp256k1-native Ruby gem: timing leak can expose secret scalars in native builds

The secp256k1-native Ruby gem's constant-time scalar multiplication can be compiled by some GCC versions into secret-dependent branches, so timing measurements can leak secret key or nonce bits. An attacker who can observe timing of repeated multiplications with a secret scalar may statistically recover scalar bits.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed gem version with `gem list secp256k1-native`; versions before `0.18.0` are in scope per the description
- Confirm whether the gem uses the native build (not pure Ruby) and which GCC compiled it, for example with `gcc --version`, since GCC 14.3.0, 15.1.0 and 15.2.0 reproduced the issue
- Identify whether any code path multiplies a secret private key or nonce via `Point#mul` or `scalar_multiply_ct` where timing may be observable

## Fix

- `secp256k1-native` `0.18.0`, which contains the verified fix per the description

## Timeline

- 2026-10-30T23:26:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63410

## From the sources

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The `Montgomery ladder` uses `uint256_select` with an all-zeros or all-ones mask, but affected GCC builds at `-O2` recover the original condition and emit secret-dependent `je` or `jne` jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 `jp_add_internal` infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or `ctgrind` on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and `extconf.rb` appends `-O2`. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time `cmov`; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. `Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom.` Version 0.18.0 contains the verified fix. The advisory's broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_