In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions.
CVSS 3.1HIGH 7.4·Network·No auth·No interaction·EPSS 0.01091·Published 2019-11-18·Fixed in 1.0.6CWE-203