Skip to content
Fencer Intel
high —

GHSA-cp57-fq8g-qh6v json

libcrux has an Incorrect Check of Signer Response Norm During Verification

published 8mo ago modified 7mo ago also RUSTSEC-2026-0077

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The ML-DSA verification algorithm as specified in [FIPS 204, subsection 6.3](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf#subsection.6.3) requires verifiers to check that the infinity norm of the deserialized signer response $z$ does not exceed $\gamma_1 - \beta$ (line 13 of Algorithm 8). The same check is required to be performed during signature generation.

libcrux-ml-dsa did not perform this check correctly during signature verification, accepting signatures with signer response norm above the allowed maximum value. The check is correctly performed during signing.

## Impact Applications using libcrux-ml-dsa for signature verification would have accepted signatures that would be rejected by a conforming implementation.

## Mitigation Starting from version `0.0.8`, signature verification uses the correct value for $\gamma_1$ in the signer response norm check.

Patch / fix

  • crates.io libcrux-ml-dsa 0.0.8

Is GHSA-cp57-fq8g-qh6v in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io libcrux-ml-dsa
<0.0.8
>=0.0.0-0, <0.0.8
0.0.8

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.