ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto `ml-dsa` crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be **strictly increasing**. The current implementation uses a non-strict monotonic check (`<=` instead of `<`), allowing duplicate indices. This is a regression bug. The original implementation was correct, but a commit in version 0.0.4 inadvertently changed the strict `<` comparison to `<=`, introducing the vulnerability. Version 0.1.0-rc.4 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RustCrypto | signatures | 0.0.4 to before 0.1.0-rc.4 | 0.1.0-rc.4 | Patch available | CNA |
| — | ml-dsa (crates.io) | 0.0.4 to before 0.1.0-rc.4 | 0.1.0-rc.4 | Patch available | GHSA-5x2r-hc65-25f9 |
- signatures VendorRustCrypto Affected 0.0.4 to before 0.1.0-rc.4 Fixed in 0.1.0-rc.4 Patch available CNA
- ml-dsa (crates.io) Vendor— Affected 0.0.4 to before 0.1.0-rc.4 Fixed in 0.1.0-rc.4 Patch available GHSA-5x2r-hc65-25f9
Remediation
- Fix · CNA signatures (RustCrypto) Fixed in 0.1.0-rc.4
- Fix · GHSA-5x2r-hc65-25f9 ml-dsa (crates.io) Fixed in 0.1.0-rc.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24850
- 2026-10-03 Alias added: GHSA-5x2r-hc65-25f9
References
Other 12
- https://github.com/RustCrypto/signatures/security/advisories/GHSA-5x2r-hc65-25f9
- https://github.com/RustCrypto/signatures/issues/894
- https://github.com/RustCrypto/signatures/pull/895
- https://github.com/RustCrypto/signatures/commit/400961412be2e2ab787942cf30e0a9b66b37a54a
- https://github.com/RustCrypto/signatures/commit/b01c3b73dd08d0094e089aa234f78b6089ec1f38
- https://csrc.nist.gov/pubs/fips/204/final
- https://datatracker.ietf.org/doc/html/rfc9881
- https://github.com/C2SP/wycheproof
- https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_44_verify_test.json
- https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_65_verify_test.json
- https://github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_87_verify_test.json
- https://github.com/RustCrypto/signatures
More RustCrypto vulnerabilities
- TI-2026-18943 RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz CVSS 4.0HIGH 8.9
- TI-2026-18227 RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE CVSS 3.1HIGH 7.5
- TI-2026-18226 RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() CVSS 3.1HIGH 7.5
- TI-2025-20333 AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure CVSS 4.0MEDIUM 5.6
- TI-2023-22902 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure CVSS 3.1MEDIUM 5.5
- TI-2026-36944 RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set CVSS 4.0LOW 2.0
Sources
- CVE-2026-24850 · CVE Program
- CVE-2026-24850 · NVD
- FIRST EPSS
- GHSA-5x2r-hc65-25f9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences