RUSTSEC-2025-0128: CGGMP21 presignatures can be used in the way that significantly reduces security

What to do

1. See which version you have: cargo tree -i cggmp24 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p cggmp24. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example cggmp24 = "0.7.0-alpha.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

This attack is against presignatures used in very specific context:

• Presignatures + HD wallets derivation: security level reduces to 85 bits \ Previously you could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API.
• Presignatures + "raw signing" (when signer signs a hash without knowing an original message): results into signature forgery attack \ Previously, you could use Presignature::issue_partial_signature with hashed message without ever providing original mesage. In new API, this method only accepts digests for which original message has been observed.

Patches

cggmp24 v0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security. Follow the migration guidelines to upgrade.

Workarounds

You can continue using un-patched versions of library as long as you don't use presignatures in said scenarios where it weakens system security. To be sure, migrate to patched version that excludes presignatures from being used in such scenarios.

References

Read our blog post to learn more.

References

• Package: crates.io/crates/cggmp24
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0128.html
• Web: www.dfns.co/article/cggmp21-vulnerabilities-patched-and-explained

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for cggmp24

• VulnerabilityRUSTSEC-2025-0130 · 2025-11-24Missing check in ZK proof in CGGMP21 Threshold Signing Protocol

Full security history of cggmp24