CVE-2026-34610

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.

These are all security issues fixed in the leancrypto-devel-1.7.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for leancrypto fixes the following issues

Security issue:

• CVE-2026-34610: The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when stori (bsc#1261382).

Non security issues:

• gnutls Illegal instruction lc_kyber_768_kem_dec_selftest (bsc#1253654).
• gnutls: test pqc-hybrid-kx fails on Nehalem or older CPU (bsc#1254370).

Changes for leancrypto:

• Calculate the FIPS HMAC for the leancrypto and the leancrypto-fips libraries. (bsc#1262399)
• Fix build on kernel 7.0
• Pick fix for ABI issue in AVX2 assembly for Curve448 causing test failures when building with GCC 16.
• Update to 1.7.2:

• Fix RDSEED counter
• Process code by AI code checkers and apply suggested cosmetic fixes
• Heap memory: always munlock all mlock'ed memory
• Fix ChaCha20 on Apple compiled with XCode 26.4
• Fix a potential crasher with Base64 and applied various fixes reported
• Add X.509 certificate signing request (CSR) generator and parser
• ML-DSA: add lc_dilithium_pk_from_sk API to derive the PK from a given SK
• SLH-DSA: add lc_sphincs_pk_from_sk API to derive the PK from a given SK
• ML-KEM: add lc_kyber_pk_from_sk API to derive the PK from a given SK
• AES-CT: fix non-aligned data processing - reported
• Apply suggestions from Claude code
• X.509: Enforce path length restriction

• Update to 1.7.1

• Offer a means to select the AES-C constant time / S-Box implementation via lc_init API
• use the AES-C constant time implementation by default - it is about 3 times slower than the AES-C S-Box implementation, but more secure. As the leancrypto library is about secure by default, the CT implementation is just right. Furthermore, if a caller wants to have the faster AES-C S-Box, he can call lc_init(LC_INIT_AES_SBOX) at the beginning.
• FIPS: mark only seeded DRBG instances as FIPS-approved
• ASN.1: add lc_x509_cert_check_issuer_ca convenience function
• Enable side-channel-resistant AES implementation (and thus enable respective Timecop tests)
• Fix some side channel test failures (all failures are due to test case issues, and no real problems)
• AARCH64: enable GCS support
• Add PKCS#8 support for ML-DSA following RFC9881 including full support for the seed or full keys. The change adds OpenSSL interoperability testing as well. NOTE: The raw on-disk private key format that is generated with lc_x509_generate --create-keypair changed to comply with RFC9881.
• Add PKCS#8 support for SLH-DSA. The change adds OpenSSL interoperability testing as well. NOTE: The raw on-disk private key format that is generated with lc_x509_generate --create-keypair changed to dump the raw key instead of wrapping it into a BIT STRING to comply with OpenSSL's format.
• Provide full PKCS#7 interoperability with OpenSSL: OpenSSL artificially orders the parsing of the authenticated attributes. This implies that the message digest part of the authenticated attributes is parsed as last entry. This ordering is important for the signature generation and verification. Furthermore, for ML-DSA/SLH-DSA, the authenticated attributes are signed with the pure algorithm instead of the pre-hashed operation as suggested by RFC5652 section 9.2.
• ML-KEM/DSA: add safety measures against compilers trying to reason about code they should not reason about. Derived from https://github.com/pq-code-package/ml[dsa|kem]-native/
• ML-DSA: reduce amount of duplicate code compilation suggested
• ML-DSA: fix bug in poly_uniform which, however, is unlikely to be triggered
• ChaCha20: fix crasher when assembler support is not compiled
• Add AES constant time C implementation accessible with the lc_aes_*ct references. Yet, it is about 3 times slower than the default C implementation. Thus is is only provided if somebody truly relies on a constant time implementation.

• Fix bsc#1254370,…

This update for leancrypto fixes the following issues

Security issue:

• CVE-2026-34610: The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when stori (bsc#1261382).

Non security issues:

• gnutls Illegal instruction lc_kyber_768_kem_dec_selftest (bsc#1253654).
• gnutls: test pqc-hybrid-kx fails on Nehalem or older CPU (bsc#1254370).

Changes for leancrypto:

• Calculate the FIPS HMAC for the leancrypto and the leancrypto-fips libraries. (bsc#1262399)
• Fix build on kernel 7.0
• Pick fix for ABI issue in AVX2 assembly for Curve448 causing test failures when building with GCC 16.
• Update to 1.7.2:

• Fix RDSEED counter
• Process code by AI code checkers and apply suggested cosmetic fixes
• Heap memory: always munlock all mlock'ed memory
• Fix ChaCha20 on Apple compiled with XCode 26.4
• Fix a potential crasher with Base64 and applied various fixes reported
• Add X.509 certificate signing request (CSR) generator and parser
• ML-DSA: add lc_dilithium_pk_from_sk API to derive the PK from a given SK
• SLH-DSA: add lc_sphincs_pk_from_sk API to derive the PK from a given SK
• ML-KEM: add lc_kyber_pk_from_sk API to derive the PK from a given SK
• AES-CT: fix non-aligned data processing - reported
• Apply suggestions from Claude code
• X.509: Enforce path length restriction

• Update to 1.7.1

• Offer a means to select the AES-C constant time / S-Box implementation via lc_init API
• use the AES-C constant time implementation by default - it is about 3 times slower than the AES-C S-Box implementation, but more secure. As the leancrypto library is about secure by default, the CT implementation is just right. Furthermore, if a caller wants to have the faster AES-C S-Box, he can call lc_init(LC_INIT_AES_SBOX) at the beginning.
• FIPS: mark only seeded DRBG instances as FIPS-approved
• ASN.1: add lc_x509_cert_check_issuer_ca convenience function
• Enable side-channel-resistant AES implementation (and thus enable respective Timecop tests)
• Fix some side channel test failures (all failures are due to test case issues, and no real problems)
• AARCH64: enable GCS support
• Add PKCS#8 support for ML-DSA following RFC9881 including full support for the seed or full keys. The change adds OpenSSL interoperability testing as well. NOTE: The raw on-disk private key format that is generated with lc_x509_generate --create-keypair changed to comply with RFC9881.
• Add PKCS#8 support for SLH-DSA. The change adds OpenSSL interoperability testing as well. NOTE: The raw on-disk private key format that is generated with lc_x509_generate --create-keypair changed to dump the raw key instead of wrapping it into a BIT STRING to comply with OpenSSL's format.
• Provide full PKCS#7 interoperability with OpenSSL: OpenSSL artificially orders the parsing of the authenticated attributes. This implies that the message digest part of the authenticated attributes is parsed as last entry. This ordering is important for the signature generation and verification. Furthermore, for ML-DSA/SLH-DSA, the authenticated attributes are signed with the pure algorithm instead of the pre-hashed operation as suggested by RFC5652 section 9.2.
• ML-KEM/DSA: add safety measures against compilers trying to reason about code they should not reason about. Derived from https://github.com/pq-code-package/ml[dsa|kem]-native/
• ML-DSA: reduce amount of duplicate code compilation suggested
• ML-DSA: fix bug in poly_uniform which, however, is unlikely to be triggered
• ChaCha20: fix crasher when assembler support is not compiled
• Add AES constant time C implementation accessible with the lc_aes_*ct references. Yet, it is about 3 times slower than the default C implementation. Thus is is only provided if somebody truly relies on a constant time implementation.

• Fix bsc#1254370,…

This update for leancrypto fixes the following issues

Security issue:

• CVE-2026-34610: The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when stori (bsc#1261382).

Non security issues:

• gnutls Illegal instruction lc_kyber_768_kem_dec_selftest (bsc#1253654).
• gnutls: test pqc-hybrid-kx fails on Nehalem or older CPU (bsc#1254370).

Changes for leancrypto:

• Calculate the FIPS HMAC for the leancrypto and the leancrypto-fips libraries. (bsc#1262399)
• Fix build on kernel 7.0
• Pick fix for ABI issue in AVX2 assembly for Curve448 causing test failures when building with GCC 16.
• Update to 1.7.2:

• Fix RDSEED counter
• Process code by AI code checkers and apply suggested cosmetic fixes
• Heap memory: always munlock all mlock'ed memory
• Fix ChaCha20 on Apple compiled with XCode 26.4
• Fix a potential crasher with Base64 and applied various fixes reported
• Add X.509 certificate signing request (CSR) generator and parser
• ML-DSA: add lc_dilithium_pk_from_sk API to derive the PK from a given SK
• SLH-DSA: add lc_sphincs_pk_from_sk API to derive the PK from a given SK
• ML-KEM: add lc_kyber_pk_from_sk API to derive the PK from a given SK
• AES-CT: fix non-aligned data processing - reported
• Apply suggestions from Claude code
• X.509: Enforce path length restriction

• Update to 1.7.1

• Offer a means to select the AES-C constant time / S-Box implementation via lc_init API
• use the AES-C constant time implementation by default - it is about 3 times slower than the AES-C S-Box implementation, but more secure. As the leancrypto library is about secure by default, the CT implementation is just right. Furthermore, if a caller wants to have the faster AES-C S-Box, he can call lc_init(LC_INIT_AES_SBOX) at the beginning.
• FIPS: mark only seeded DRBG instances as FIPS-approved
• ASN.1: add lc_x509_cert_check_issuer_ca convenience function
• Enable side-channel-resistant AES implementation (and thus enable respective Timecop tests)
• Fix some side channel test failures (all failures are due to test case issues, and no real problems)
• AARCH64: enable GCS support
• Add PKCS#8 support for ML-DSA following RFC9881 including full support for the seed or full keys. The change adds OpenSSL interoperability testing as well. NOTE: The raw on-disk private key format that is generated with lc_x509_generate --create-keypair changed to comply with RFC9881.
• Add PKCS#8 support for SLH-DSA. The change adds OpenSSL interoperability testing as well. NOTE: The raw on-disk private key format that is generated with lc_x509_generate --create-keypair changed to dump the raw key instead of wrapping it into a BIT STRING to comply with OpenSSL's format.
• Provide full PKCS#7 interoperability with OpenSSL: OpenSSL artificially orders the parsing of the authenticated attributes. This implies that the message digest part of the authenticated attributes is parsed as last entry. This ordering is important for the signature generation and verification. Furthermore, for ML-DSA/SLH-DSA, the authenticated attributes are signed with the pure algorithm instead of the pre-hashed operation as suggested by RFC5652 section 9.2.
• ML-KEM/DSA: add safety measures against compilers trying to reason about code they should not reason about. Derived from https://github.com/pq-code-package/ml[dsa|kem]-native/
• ML-DSA: reduce amount of duplicate code compilation suggested
• ML-DSA: fix bug in poly_uniform which, however, is unlikely to be triggered
• ChaCha20: fix crasher when assembler support is not compiled
• Add AES constant time C implementation accessible with the lc_aes_*ct references. Yet, it is about 3 times slower than the default C implementation. Thus is is only provided if somebody truly relies on a constant time implementation.

• Fix bsc#1254370,…