GHSA-xrf2-5r3p-5wgj
libcrux: Panic in Signature Hint Decoding During Verification
GHSA-xrf2-5r3p-5wgj is a high vulnerability (CVSS 8.7) in libcrux-ml-dsa, published March 4, 2026. No source lists public exploit code. Fixed in libcrux-ml-dsa 0.0.8.
- Severity
- 8.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.0.8libcrux-ml-dsa +1 more
Description
During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 HintBitUnpack of FIPS 204, subsection 7.1. The algorithm requires that the cumulative hint counters per row of the hint vector are strictly increasing and below a maximum value which depends on the choice of ML-DSA parameter set (line 4).
In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector.
Impact
A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic.
Mitigation
Starting from version 0.0.8, hint decoding will check the cumulative hint counter of the last row as well.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcrux-ml-dsacrates.io | before 0.0.8 | 0.0.8 |
libcrux-ml-dsacrates.io | 0.0.0-0 up to 0.0.8 | 0.0.8 |
What each source reports
GitHub Advisories Score used
libcrux: Panic in Signature Hint Decoding During Verification
During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 HintBitUnpack of FIPS 204, subsection 7.1. The algorithm requires that the cumulative hint counters per row of the hint vector are strictly increasing and below a maximum value which depends on the choice of ML-DSA parameter set (line 4).
In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector.
Impact
A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic.
Mitigation
Starting from version 0.0.8, hint decoding will check the cumulative hint counter of the last row as well.
- Record
GHSA-xrf2-5r3p-5wgj- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-1285
- Updated
- 2026-11-02
OSV
libcrux: Panic in Signature Hint Decoding During Verification
During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 HintBitUnpack of FIPS 204, subsection 7.1. The algorithm requires that the cumulative hint counters per row of the hint vector are strictly increasing and below a maximum value which depends on the choice of ML-DSA parameter set (line 4).
In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector.
Impact
A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic.
Mitigation
Starting from version 0.0.8, hint decoding will check the cumulative hint counter of the last row as well.
- Record
GHSA-xrf2-5r3p-5wgj- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-1285
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0076
Panic in Signature Hint Decoding During Verification
During ML-DSA verification the serialized hint values are decoded as
specified in algorithm 22 HintBitUnpack of FIPS 204, subsection
7.1. The
algorithm requires that the cumulative hint counters per row of the
hint vector are strictly increasing and below a maximum value which
depends on the choice of ML-DSA parameter set (line 4).
In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector.
Impact
A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic.
Mitigation
Starting from version 0.0.8, hint decoding will check the cumulative
hint counter of the last row as well.
- Record
RUSTSEC-2026-0076- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.