crates.io/ml-dsa CVE-2026-22705: medium 6.4, EPSS 0.16%
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Action: Upgrade ml-dsa to 0.1.0-rc.3 or later.
cargo update -p ml-dsa --precise 0.1.0-rc.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.1.0-rc.3 | - |
Fixed versions
| 0.1.0-rc.3 |
Sources
- osv: GHSA-hcp2-x6j4-29j7
- https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7
- https://nvd.nist.gov/vuln/detail/CVE-2026-22705
- https://github.com/RustCrypto/signatures/pull/1144
- https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558
- https://github.com/RustCrypto/signatures
- https://rustsec.org/advisories/RUSTSEC-2025-0144.html
CVE-2026-22705 · published · modified · JSON