Forge has signature forgery in Ed25519 due to missing S > L check

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33895 · Microsoft / collected KEV context

EUVD-2026-16835

GHSA-q67f-28xg-22rw

cve-program · CVE-2026-33895

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85
• https://datatracker.ietf.org/doc/html/rfc8032#section-8.4

euvd · EUVD-2026-16835

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85
• https://datatracker.ietf.org/doc/html/rfc8032#section-8.4

nvd · CVE-2026-33895

• https://datatracker.ietf.org/doc/html/rfc8032#section-8.4
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw
• https://access.redhat.com/errata/RHSA-2026:13826
• https://access.redhat.com/errata/RHSA-2026:24761
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:9742
• https://access.redhat.com/security/cve/CVE-2026-33895
• https://bugzilla.redhat.com/show_bug.cgi?id=2452457
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33895.json

osv · GHSA-q67f-28xg-22rw

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw
• https://nvd.nist.gov/vuln/detail/CVE-2022-35961
• https://nvd.nist.gov/vuln/detail/CVE-2026-25793
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85
• https://datatracker.ietf.org/doc/html/rfc8032#section-8.4
• https://github.com/digitalbazaar/forge

No related operational record is retained in the current change model.