CVE-2022-23806: Debian Linux

Critical severity, CVSS 9.1. EPSS: 3.1% chance of exploitation in the next 30 days.

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

Affected products

• Debian Debian Linux: version 9.0 only
• Golang Go: before 1.16.14 (fixed in 1.16.14); from 1.17.0, before 1.17.7 (fixed in 1.17.7)
• Netapp Beegfs Csi Driver: affected versions not specified
• Netapp Cloud Insights Telegraf Agent: affected versions not specified
• Netapp Kubernetes Monitoring Operator: affected versions not specified
• Netapp Storagegrid: affected versions not specified

Published 2022-02-11. Last modified 2026-06-17.