{"action":"Upgrade fastecdsa to 2.3.2 or later.","affected":[{"fixed":"2.3.2","introduced":"0"}],"component":"fastecdsa","cve_ids":["CVE-2024-21502"],"ecosystem":"PyPI","epss":0.01034,"exploited":false,"fixed_versions":["2.3.2"],"ghsa_id":"GHSA-ph86-g9r3-5qw4","id":"tcs_01M5KGN78VG75SJD64T1GR2J0X","modified_at":"2026-06-10T17:01:16.815475179Z","published_at":"2024-02-24T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-39","https://security.snyk.io/vuln/SNYK-PYTHON-FASTECDSA-6262045","https://gist.github.com/keltecc/49da037072276f21b005a8337c15db26","https://github.com/AntonKueltz/fastecdsa/blob/v2.3.1/src/curveMath.c%23L210","https://github.com/AntonKueltz/fastecdsa/commit/57fc5689c95d649dab7ef60cc99ac64589f01e36","https://github.com/advisories/GHSA-ph86-g9r3-5qw4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-39","url":"https://osv.dev/vulnerability/PYSEC-2024-39"}],"summary":"Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as use"}