In wolfSSL prior to 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks.
wolfssl wolfssl