RUSTSEC-2026-0426

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0426

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0426.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0426

Aliases

GHSA-r7wm-4vf2-h44w

Published

2026-10-30T12:00:00Z

Modified

2026-10-30T11:15:02Z

Summary

LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

Details

Summary

On targets that do not have a conditional move/select operations, LLVM compiles the internal conditional_sub_u32() function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys.

conditional_sub_u32() is used throughout the field arithmetic of both ML-KEM and ML-DSA.

Impact

The variable-time jumps have been observed for ML-KEM and ML-DSA on:

i586-unknown-linux-gnu
s390x-unknown-linux-gnu

Additionally, ML-DSA sees the vulnerable LLVM optimization on x86_64-unknown-linux-gnu, for hazardous::dsa::mldsa44 and hazardous::dsa::mldsa87.

The leakage this LLVM optimization introduces could enable recovery of cryptographic secrets. The practicality of exploiting the leakage depends on the compiler, target CPU used and how "close" to the process using the vulnerable functions the attacker is.

Resolution

Upgrade to v0.17.16 or v0.18.1. conditional_sub_u32() has been re-written to take conditional-move/jump ops availability into account.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / orion

Package

Name: orion; View open source insights on deps.dev
Purl: pkg:cargo/orion

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.17.16

Introduced

0.18.0-0

Fixed

0.18.1

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [
            "s390x",
            "x86",
            "x86_64"
        ],
        "functions":  [],
        "os":  []
    }
}