Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The ml-dsa crate for Rust, versions from 0.0.4 up to but not including 0.1.0-rc.4, accepts signatures with repeated hint indices during verification, which allows signature malleability. An attacker who has a valid signature can produce additional byte-level encodings that also verify for the same message and key. Upgrade to ml-dsa 0.1.0-rc.4 or later, where the fix is included.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0034, the 27th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:19 UTC First seen by agentprime
- 31 Oct 2026, 15:19 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-5x2r-hc65-25f9
- OSV: GHSA-5x2r-hc65-25f9
- github.com/RustCrypto/signatures/security/advisories/GHSA-5x2r-hc65-25f9
- nvd.nist.gov/vuln/detail/CVE-2026-24850
- github.com/RustCrypto/signatures/issues/894
- github.com/RustCrypto/signatures/pull/895
- github.com/RustCrypto/signatures/commit/400961412be2e2ab787942cf30e0a9b66b37a54a
- github.com/RustCrypto/signatures/commit/b01c3b73dd08d0094e089aa234f78b6089ec1f38
- csrc.nist.gov/pubs/fips/204/final
- datatracker.ietf.org/doc/html/rfc9881
- github.com/C2SP/wycheproof
- github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_44_verify_test.json
- github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_65_verify_test.json
- github.com/C2SP/wycheproof/blob/master/testvectors_v1/mldsa_87_verify_test.json