CVE-2026-24850: ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices
The ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be strictly increasing. The current implementation uses a non-strict monotonic check (<= instead of <), allowing duplicate indices.
Note: This is a regression bug. The original implementation was correct, but commit b01c3b7 (“Make ML-DSA signature decoding follow the spec (#895)”, fixing issue #894) inadvertently changed the strict < comparison to <=, introducing the vulnerability.
References
- csrc.nist.gov/pubs/fips/204/final
- datatracker.ietf.org/doc/html/rfc9881
- github.com/C2SP/wycheproof
- github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_44_verify_test.json
- github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_65_verify_test.json
- github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_87_verify_test.json
- github.com/RustCrypto/signatures
- github.com/RustCrypto/signatures/commit/400961412be2e2ab787942cf30e0a9b66b37a54a
- github.com/RustCrypto/signatures/commit/b01c3b73dd08d0094e089aa234f78b6089ec1f38
- github.com/RustCrypto/signatures/issues/894
- github.com/RustCrypto/signatures/pull/895
- github.com/RustCrypto/signatures/security/advisories/GHSA-5x2r-hc65-25f9
- github.com/advisories/GHSA-5x2r-hc65-25f9
- nvd.nist.gov/vuln/detail/CVE-2026-24850
Code Behaviors & Features
Detect and mitigate CVE-2026-24850 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →