CVE-2016-7055

CVE-2016-7055 is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure within OpenSSL versions 1.0.2 and 1.1.0 before 1.1.0c, affecting products like Node.js that utilize these OpenSSL versions. The vulnerability can lead to transient authentication and key negotiation failures or erroneous public-key operations with specially crafted input, specifically impacting Brainpool P-512 curves in EC algorithms. Rated Medium with a CVSS score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), it has a high attack complexity and can result in denial of service. While attacks against RSA, DSA, and DH private keys are deemed impossible, ECDH key negotiation could be vulnerable under specific, non-default conditions. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, indicating low public attention.