Buffer overflow in deserialization in oqs-provider
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODE_UINT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. Unchecked length values are later used for memory reads and writes; malformed input can lead to crashes or information leakage. Handling of plain/non-hybrid PQ key operation is not affected. This issue has been patched in in v0.6.1. All users are advised to upgrade. There are no workarounds for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-quantum-safe | oqs-provider | before 0.6.1 | 0.6.1 | Patch available | CNA |
- oqs-provider Vendoropen-quantum-safe Affected before 0.6.1 Fixed in 0.6.1 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:open_quantum_safe:oqs_provider:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:open_quantum_safe:oqs_provider:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA oqs-provider (open-quantum-safe) Fixed in 0.6.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37305
References
More open-quantum-safe vulnerabilities
- TI-2024-20867 An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate… CVSS 3.1CRITICAL 9.8
- TI-2024-36253 liboqs has a correctness error in HQC decapsulation CVSS 3.1HIGH 7.5
- TI-2024-24191 Control-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other options CVSS 3.1HIGH 7.5
- TI-2026-34064 liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194) CVSS 3.1MEDIUM 5.3
- TI-2026-32448 liboqs: XMSS Buffer Overread Bug CVSS 3.1MEDIUM 5.3
- TI-2025-32600 liboqs secret-dependent branching in HQC reference implementation when compiled with Clang 17-20 CVSS 3.1MEDIUM 5.9
Sources
- CVE-2024-37305 · CVE Program
- CVE-2024-37305 · NVD
- FIRST EPSS
- CVE-2024-37305 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences