CVE-2026-22705
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Summary
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Original description
The description as published by the source.
RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
crates.io
ml-dsa
[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.1.0-rc.3"}]}]
References
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package crates.io
- patch github.com
- patch github.com