CVE-2026-3706: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3706 is an Ed25519 signature malleability vulnerability in mkj Dropbear SSH affecting versions up to 2025.89. The flaw resides in the unpackneg function within src/curve25519.c, where the scalar component S of an Ed25519 signature is not validated to be less than the group order L (i.e., no S < L range check). This omission allows an attacker to construct an alternative, non-canonical signature (S' = S + L) that passes verification, violating the Strong Existential Unforgeability under Chosen Message Attacks (SUF-CMA) property. The vulnerability was reported by YuJie Zhu on February 23, 2026, and publicly disclosed on March 8, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (Feedly, VulDB).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature) and CWE-345 (Insufficient Verification of Data Authenticity). In Dropbear's TweetNaCl-derived Ed25519 implementation, the dropbear_ed25519_verify function in src/curve25519.c directly uses the scalar S (bytes 32–63 of the signature) without first checking that S < L, where L is the Ed25519 group order. Because Ed25519 arithmetic is performed modulo L, a signature with S' = S + L produces the same verification result as the original, making signatures malleable. The attack is network-accessible but requires high complexity, as it targets the internal cryptographic API rather than the SSH protocol layer directly — the Dropbear maintainer notes that "Signature Malleability is not exploitable in SSH protocol" because the SSH protocol does not expose a path for an attacker to substitute a malleable signature in a meaningful way. A public PoC demonstrating the internal API vulnerability was included in the original GitHub issue report (Dropbear Issue #406, Dropbear PR #407).

The practical impact of this vulnerability is limited to a low-integrity effect: an adversary who already possesses a valid Ed25519 signature can forge an alternative valid signature for the same message by computing S' = S + L. This breaks signature uniqueness and could undermine higher-level security policies, auditing logic, or replay-detection mechanisms that assume signature canonicality. There is no confidentiality or availability impact, and the Dropbear maintainer explicitly states the issue has no security impact within the SSH protocol as deployed (Dropbear PR #407, Feedly).

A public proof-of-concept C program was published in the original GitHub issue (#406) demonstrating that Dropbear's dropbear_ed25519_verify function accepts both an original signature and its S+L malleable variant. However, the PoC targets the internal API and not the SSH protocol itself, and the maintainer confirms no practical SSH-level exploit exists. The EPSS score is extremely low at 0.000110, reflecting the very limited real-world exploitability. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Dropbear Issue #406, Feedly).

1. Obtain a valid Ed25519 signature: Acquire a legitimate Ed25519 signature (64 bytes) produced by a Dropbear instance for any message, along with the corresponding public key.
2. Compute the malleable signature: Add the Ed25519 group order L (little-endian: 0xed, 0xd3, 0xf5, 0x5c, ...0x10) to the scalar component S (bytes 32–63 of the signature) using byte-wise addition with carry to produce S' = S + L.
3. Submit the malleable signature: Pass the modified 64-byte signature (R || S') to dropbear_ed25519_verify via the internal API along with the original message and public key.
4. Observe acceptance: The vulnerable Dropbear versions (≤ 2025.89) will accept the malleable signature as valid, demonstrating the lack of the S < L range check. Note: this exploit path operates at the internal API level and does not translate to a practical SSH protocol attack (Dropbear Issue #406, Dropbear PR #407).

The Dropbear maintainer merged a fix (commit fdec3c90a15447bd538641d85e5a3e3ac981011d) on March 25, 2026, adding an s_lt_l() function that checks S < L before proceeding with signature verification in dropbear_ed25519_verify. Users should update to a Dropbear release incorporating this commit (post-2025.89, e.g., 2026.91 or later). No configuration-based workaround is available; patching is the only remediation (Dropbear Commit, Dropbear PR #407).

The Dropbear maintainer (mkj) acknowledged the report and noted that while the missing S < L check is a deviation from RFC 8032 requirements, "Signature Malleability is not exploitable in SSH protocol" and "a PoC doesn't exist for SSH implementation, but rather it's against the internal API." The fix was nonetheless merged to bring the implementation into compliance with RFC 8032 and FIPS 196-5. The issue was also cross-referenced with similar historical vulnerabilities in other Ed25519 implementations (e.g., ed25519-java, CVE-2020-36843) (Dropbear PR #407, ed25519-java Issue #82).