validate pre-key key-id ranges

F-SIGNAL-SERVER-PREKEY-001

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Recorded evidence

—score not recorded

signalapp/Signal-ServerReported fixsignalapp/Signal-Server

validate pre-key key-id ranges

likely fixed publicly (conditional mapping)

details

Finding IDs: F-SIGNAL-SERVER-PREKEY-001
Status: likely fixed publicly (conditional mapping)
Reported via: private security contact
Note: public Signal-Server commits b7d455ed1140, b441fde2130, and fb84066f09df validate pre-key key-id ranges, enforce positive signed 32-bit ids, and align gRPC prekey rate-limit keys; these commits are present in tag v20260618.2.0. mapped to F-SIGNAL-SERVER-PREKEY-001 only if the private report concerned prekey key_id ranges / invalid ids / gRPC prekey limiter behavior; if it concerned depletion or last-resort semantics, an exact public fix was not observed.

F-SIGNAL-SERVER-PREKEY-001: Needs source detail. Key-ID validation and key-depletion semantics are different mechanisms; the public mapping does not resolve which applies. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-SIGNAL-SERVER-PREKEY-001

Security area (1seal assessment): Unclassified. The key-ID range patch is public, but the record also allows a different prekey-depletion interpretation. The exact finding-to-patch mapping must be resolved first. Reviewed 24 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.