CVE-2026-46344

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a correctly-sized signature buffer for the declared algorithm but a public key whose OID bytes (pk[0..3]) reference a different XMSS parameter set with a larger sig_bytes, the implementation re-parses the OID from the public key inside xmss_sign_open / xmssmt_sign_open and uses the resulting (larger) sig_bytes to index the caller-supplied signature buffer. As with CVE-2026-44518, the out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a correctly-sized signature buffer for the declared algorithm but a public key whose OID bytes (pk[0..3]) reference a different XMSS parameter set with a larger sig_bytes, the implementation re-parses the OID from the public key inside xmss_sign_open / xmssmt_sign_open and uses the resulting (larger) sig_bytes to index the caller-supplied signature buffer. As with CVE-2026-44518, the out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a correctly-sized signature buffer for the declared algorithm but a public key whose OID bytes (pk[0..3]) reference a different XMSS parameter set with a larger sig_bytes, the implementation re-parses the OID from the public key inside xmss_sign_open / xmssmt_sign_open and uses the resulting (larger) sig_bytes to index the caller-supplied signature buffer. As with CVE-2026-44518, the out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a correctly-sized signature buffer for the declared algorithm but a public key whose OID bytes (pk[0..3]) reference a different XMSS parameter set with a larger sig_bytes, the implementation re-parses the OID from the public key inside xmss_sign_open / xmssmt_sign_open and uses the resulting (larger) sig_bytes to index the caller-supplied signature buffer. As with CVE-2026-44518, the out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.

These are all security issues fixed in the liboqs-devel-0.16.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for liboqs fixes the following issues:

Changes in liboqs:

Updated to 0.16.0:

Deprecation notice:

• SPHINCS+ was removed in 0.16.0.

Security issues:

• Fixed uninitialized encaps_derand pointer dereference
• CVE-2026-46344, CVE-2026-44518: Fixed out-of-bounds read in XMSS/XMSS^MT signature verification (bsc#1267007 bsc#1267001)
• Fixed Integer underflow in CROSS crypto_sign_open()
• Fixed incorrect array size when calling secure_clean
• Implemented optimization barrier OQS_MEM_BLACK_BOX and applied to ct_select in FrodoKEM

Significant change:

FrodoKEM algorithm change:

• Existing FrodoKEM in 0.15.0 was renamed to ephemeral FrodoKEM (KEM_efrodokem_<640|976|1344>_<aes|shake>), and the salted variant of FrodoKEM was added under the prior names (KEM_frodokem_<640|976|1344>_<aes|shake>).

  Ephemeral FrodoKEM is recommended for applications where each keypair will encapsulate only a small number of shared secrets and ciphertexts. Standard (salted) FrodoKEM is recommended for applications where each keypair is expected to encapsulate large number of ciphertexts. Please consult upstream for more details.

• mldsa-native integration:

  mldsa-native is a secure, fast, and portable C90 implementation of the ML-DSA post-quantum signature standard. It also includes optimized builds for x86_64 and aarch64. It is now the default implementation behind SIG_ml_dsa_<44|65|87>.

• Updated HQC implementation:

  The HQC implementations in liboqs were updated to 20250822 spec. Its upstream switched from PQClean to the official repo. KEM_hqc_<1|3|5> is now enabled by default.

• MQOM integration and memory-optimized build flag:

  MQOM is a third-round candidate in NIST's Additional Digital Signatures for the PQC Standardization Process. Portable, x86_64-optimized, and memory-optimized implementations were integrate�into liboqs under OQS_ENABLE_SIG_MQOM.

• OpenSSH implementation of NTRU Prime:

  A public-domain OpenSSH implementation of NTRUPrime761 replaced the PQClean implementation as the default backend for KEM_ntruprime_sntrup761.

Bug fixes:

• Fixed incremental absorption bug in AVX512VL SHA3-512 #2442

• Implemented fallback for when EVP_DigestSqueeze is unavailable #2433

• Added API for detecting stateful signature support at runtime #2434

• Fixed missing initialization and indexing bug in LMS #2416

• Fixed erroneous MAYO_OK despite failed sample_solution() attempts in MAYO #2403

• Limited pytest parallelism to prevent memory exhaustion in constrained environment #2397

• Fixed cuPQC ML-KEM derand symbol names and #if/#elif chains #2396

• Tightened Windows compiler detection #2394

• Fixed mismatched macros in LMS #2379

• Made fuzzers tolerant to disabled algorithms #2359

• Removed inlined exponentiation in CROSS-RSDPG-1 #2357

• Fixed incorrect arg register update in AVX512 Keccak #2330

• Update to 0.15.0:

  • Significant changes:
    • Integrated SLH-DSA implementation from pq-code-package/slhdsa-c
    • SLH-DSA ACVP tests (#2237) -…

This update for liboqs fixes the following issues:

Changes in liboqs:

Updated to 0.16.0:

Deprecation notice:

• SPHINCS+ was removed in 0.16.0.

Security issues:

• Fixed uninitialized encaps_derand pointer dereference
• CVE-2026-46344, CVE-2026-44518: Fixed out-of-bounds read in XMSS/XMSS^MT signature verification (bsc#1267007 bsc#1267001)
• Fixed Integer underflow in CROSS crypto_sign_open()
• Fixed incorrect array size when calling secure_clean
• Implemented optimization barrier OQS_MEM_BLACK_BOX and applied to ct_select in FrodoKEM

Significant change:

FrodoKEM algorithm change:

• Existing FrodoKEM in 0.15.0 was renamed to ephemeral FrodoKEM (KEM_efrodokem_<640|976|1344>_<aes|shake>), and the salted variant of FrodoKEM was added under the prior names (KEM_frodokem_<640|976|1344>_<aes|shake>).

  Ephemeral FrodoKEM is recommended for applications where each keypair will encapsulate only a small number of shared secrets and ciphertexts. Standard (salted) FrodoKEM is recommended for applications where each keypair is expected to encapsulate large number of ciphertexts. Please consult upstream for more details.

• mldsa-native integration:

  mldsa-native is a secure, fast, and portable C90 implementation of the ML-DSA post-quantum signature standard. It also includes optimized builds for x86_64 and aarch64. It is now the default implementation behind SIG_ml_dsa_<44|65|87>.

• Updated HQC implementation:

  The HQC implementations in liboqs were updated to 20250822 spec. Its upstream switched from PQClean to the official repo. KEM_hqc_<1|3|5> is now enabled by default.

• MQOM integration and memory-optimized build flag:

  MQOM is a third-round candidate in NIST's Additional Digital Signatures for the PQC Standardization Process. Portable, x86_64-optimized, and memory-optimized implementations were integrate into liboqs under OQS_ENABLE_SIG_MQOM.

• OpenSSH implementation of NTRU Prime:

  A public-domain OpenSSH implementation of NTRUPrime761 replaced the PQClean implementation as the default backend for KEM_ntruprime_sntrup761.

Bug fixes:

• Fixed incremental absorption bug in AVX512VL SHA3-512 #2442

• Implemented fallback for when EVP_DigestSqueeze is unavailable #2433

• Added API for detecting stateful signature support at runtime #2434

• Fixed missing initialization and indexing bug in LMS #2416

• Fixed erroneous MAYO_OK despite failed sample_solution() attempts in MAYO #2403

• Limited pytest parallelism to prevent memory exhaustion in constrained environment #2397

• Fixed cuPQC ML-KEM derand symbol names and #if/#elif chains #2396

• Tightened Windows compiler detection #2394

• Fixed mismatched macros in LMS #2379

• Made fuzzers tolerant to disabled algorithms #2359

• Removed inlined exponentiation in CROSS-RSDPG-1 #2357

• Fixed incorrect arg register update in AVX512 Keccak #2330

• Update to 0.15.0:

  • Significant changes:
    • Integrated SLH-DSA implementation from pq-code-package/slhdsa-c
    • SLH-DSA ACVP tests (#2237)
    • Integrate…

This update for liboqs, oqs-provider fixes the following issues:

• disable KEM_HQC and SIG_MQOM and KEM_NTRUPRIME on s390x for now, testsuite shows them not working.

Updated to 0.16.0:

Deprecation notice:

• SPHINCS+ was removed in 0.16.0.

Security issues:

• Fixed uninitialized encaps_derand pointer dereference
• CVE-2026-46344, CVE-2026-44518: Fixed out-of-bounds read in XMSS/XMSS^MT signature verification (bsc#1267007 bsc#1267001)
• Fixed Integer underflow in CROSS crypto_sign_open()
• Fixed incorrect array size when calling secure_clean
• Implemented optimization barrier OQS_MEM_BLACK_BOX and applied to ct_select in FrodoKEM

Significant change:

FrodoKEM algorithm change:

• Existing FrodoKEM in 0.15.0 was renamed to ephemeral FrodoKEM (KEM_efrodokem_<640|976|1344>_<aes|shake>), and the salted variant of FrodoKEM was added under the prior names (KEM_frodokem_<640|976|1344>_<aes|shake>). Ephemeral FrodoKEM is recommended for applications where each keypair will encapsulate only a small number of shared secrets and ciphertexts. Standard (salted) FrodoKEM is recommended for applications where each keypair is expected to encapsulate large number of ciphertexts. Please consult upstream for more details.
• mldsa-native integration: mldsa-native is a secure, fast, and portable C90 implementation of the ML-DSA post-quantum signature standard. It also includes optimized builds for x86_64 and aarch64. It is now the default implementation behind SIG_ml_dsa_<44|65|87>.
• Updated HQC implementation: The HQC implementations in liboqs were updated to 20250822 spec. Its upstream switched from PQClean to the official repo. KEM_hqc_<1|3|5> is now enabled by default.
• MQOM integration and memory-optimized build flag: MQOM is a third-round candidate in NIST's Additional Digital Signatures for the PQC Standardization Process. Portable, x86_64-optimized, and memory-optimized implementations were integrate�into liboqs under OQS_ENABLE_SIG_MQOM.
• OpenSSH implementation of NTRU Prime: A public-domain OpenSSH implementation of NTRUPrime761 replaced the PQClean implementation as the default backend for KEM_ntruprime_sntrup761.

Bug fixes:

• Fixed incremental absorption bug in AVX512VL SHA3-512 #2442
• Implemented fallback for when EVP_DigestSqueeze is unavailable #2433
• Added API for detecting stateful signature support at runtime #2434
• Fixed missing initialization and indexing bug in LMS #2416
• Fixed erroneous MAYO_OK despite failed sample_solution() attempts in MAYO #2403
• Limited pytest parallelism to prevent memory exhaustion in constrained environment #2397
• Fixed cuPQC ML-KEM derand symbol names and #if/#elif chains #2396
• Tightened Windows compiler detection #2394
• Fixed mismatched macros in LMS #2379
• Made fuzzers tolerant to disabled algorithms #2359
• Removed inlined exponentiation in CROSS-RSDPG-1 #2357
• Fixed incorrect arg register update in AVX512 Keccak #2330

Update to 0.15.0:

• Significant changes:

  • Integrated SLH-DSA…