Vulnerability HighRUSTSEC-2022-0047 · oqs
RUSTSEC-2022-0047: Post-Quantum Signature scheme Rainbow level I parametersets broken
Short answerA security vulnerability in the oqs crate: Post-Quantum Signature scheme Rainbow level I parametersets broken. GitHub rates it High. Fixed in 0.7.2: update to a fixed version.
| Crate | oqs |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Before 0.7.2. |
| Fixed in | 0.7.2 |
| Severity | High (GitHub rating) |
| Published | 2022-02-25 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-h864-m8vm-3xvj |
What to do
- See which version you have:
cargo tree -i oqs(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p oqs. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleoqs = "0.7.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Ward Beullens found a practical key-recovery attack against Rainbow. The level I parametersets are removed from liboqs starting from version 0.7.2. Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop.
This means all the oqs::sig::Algorithm::RainbowI* variants are insecure.
References
- Package: crates.io/crates/oqs
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0047.html
- Web: groups.google.com/a/list.nist.gov/g/pqc-forum/c/KFgw5_qCXiI?pli=1
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for oqs
Up next
Same crateoqs: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?