RUSTSEC-2026-0076

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0076

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0076.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0076

Aliases

GHSA-xrf2-5r3p-5wgj

Published

2026-03-04T12:00:00Z

Modified

2026-03-27T05:55:06Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Panic in Signature Hint Decoding During Verification

Details

During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 HintBitUnpack of FIPS 204, subsection 7.1. The algorithm requires that the cumulative hint counters per row of the hint vector are strictly increasing and below a maximum value which depends on the choice of ML-DSA parameter set (line 4).

In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector.

Impact

A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic.

Mitigation

Starting from version 0.0.8, hint decoding will check the cumulative hint counter of the last row as well.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / libcrux-ml-dsa

Package

Name: libcrux-ml-dsa; View open source insights on deps.dev
Purl: pkg:cargo/libcrux-ml-dsa

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.0.8

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "libcrux_ml_dsa::ml_dsa_44::verify",
            "libcrux_ml_dsa::ml_dsa_65::verify",
            "libcrux_ml_dsa::ml_dsa_87::verify"
        ],
        "os": []
    }
}