RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Priority LOW 30CWE-1240Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix Fixed signatures (RustCrypto): 0.1.0-rc.2ml-dsa (crates.io): 0.1.0-rc.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RustCrypto | signatures | before 0.1.0-rc.2 | 0.1.0-rc.2 | Patch available | CNA |
| — | ml-dsa (crates.io) | before 0.1.0-rc.3 | 0.1.0-rc.3 | Patch available | GHSA-hcp2-x6j4-29j7 |
- signatures VendorRustCrypto Affected before 0.1.0-rc.2 Fixed in 0.1.0-rc.2 Patch available CNA
- ml-dsa (crates.io) Vendor— Affected before 0.1.0-rc.3 Fixed in 0.1.0-rc.3 Patch available GHSA-hcp2-x6j4-29j7
Remediation
- Fix · CNA signatures (RustCrypto) Fixed in 0.1.0-rc.2
- Fix · GHSA-hcp2-x6j4-29j7 ml-dsa (crates.io) Fixed in 0.1.0-rc.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22705
- 2026-10-03 Alias added: GHSA-hcp2-x6j4-29j7
References
Other 5
- https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7
- https://github.com/RustCrypto/signatures/pull/1144
- https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558
- https://github.com/RustCrypto/signatures
- https://rustsec.org/advisories/RUSTSEC-2025-0144.html
More RustCrypto vulnerabilities
- TI-2026-18943 RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz CVSS 4.0HIGH 8.9
- TI-2026-18227 RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE CVSS 3.1HIGH 7.5
- TI-2026-18226 RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() CVSS 3.1HIGH 7.5
- TI-2026-20049 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices CVSS 3.1MEDIUM 5.3
- TI-2025-20333 AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure CVSS 4.0MEDIUM 5.6
- TI-2023-22902 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-22705 · CVE Program
- CVE-2026-22705 · NVD
- FIRST EPSS
- GHSA-hcp2-x6j4-29j7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences