CVE-2019-9155

CVE-2019-9155 is a cryptographic vulnerability in OpenPGP.js versions up to 4.2.0 that allows an attacker to recover a victim's ECDH private key. This is achieved through an invalid curve attack, requiring the attacker to provide forged messages and receive feedback on decryption success. Rated Medium severity (CVSS 5.9), the attack has high impact on confidentiality but requires high attack complexity and no user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.