RUSTSEC-2026-0076: Panic in Signature Hint Decoding During Verification

What to do

1. See which version you have: cargo tree -i libcrux-ml-dsa (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p libcrux-ml-dsa. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example libcrux-ml-dsa = "0.0.8") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 HintBitUnpack of FIPS 204, subsection 7.1. The algorithm requires that the cumulative hint counters per row of the hint vector are strictly increasing and below a maximum value which depends on the choice of ML-DSA parameter set (line 4).

In libcrux-ml-dsa, hint decoding did not check the boundedness of the cumulative hint counter of the last row of the hint vector.

Impact

A manipulated invalid hint can cause an out-of-bounds memory access since the hint decoding logic may attempt to read outside the bounds of the serialized signature, causing a runtime panic.

Mitigation

Starting from version 0.0.8, hint decoding will check the cumulative hint counter of the last row as well.

References

• Package: crates.io/crates/libcrux-ml-dsa
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0076.html
• Web: github.com/cryspen/libcrux/pull/1348

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for libcrux-ml-dsa

• VulnerabilityRUSTSEC-2026-0077 · 2026-03-04Incorrect Check of Signer Response Norm During Verification
• VulnerabilityRUSTSEC-2026-0125 · 2026-05-05Signature Verification on AVX2 Platforms Mishandles Edge Case
• NoticeRUSTSEC-2026-0126 · 2026-04-27AVX2 Implementation Did Not Fully Reduce Intermediate Values

Full security history of libcrux-ml-dsa