cryspen libcrux-ml-dsa signature verification bypass on AVX2 platforms

Severity: high · CVSS 8.2 · Published 2026-05-19

libcrux-ml-dsa is a Rust library providing post-quantum cryptographic digital signature algorithms. A flaw in its high-performance AVX2 implementation causes the library to incorrectly verify certain digital signatures. An attacker could exploit this to make the system accept a forged or invalid signature, potentially allowing them to bypass security checks or impersonate authorized users.

Technologies: libcrux-ml-dsa (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.2, published 19 May 2026.
Which products and versions are affected?
libcrux-ml-dsa (crates.io) < 0.0.9.
Is there a fix for This vulnerability?
A patch was published on 2026-05-19: Fixed in version 0.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run libcrux-ml-dsa (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the AVX2-optimized implementation of ML-DSA (Module-Lattice-Based Digital Signature Standard) within the libcrux-ml-dsa crate. The root cause is an incorrect implementation of the `use_hint` function (Algorithm 40 in FIPS 204), specifically regarding the handling of the edge case where the remainder $r_0$ equals 0. While the specification requires $r_0 \le 0$ to trigger a specific modular reduction, the AVX2 implementation using the `vec256_blendv_epi32` intrinsic only checked for $r_0 < 0$. This discrepancy allows an attacker to craft an invalid signature under a maliciously generated verification key that the verifier will incorrectly accept as valid. The issue is fixed in version 0.0.9 by correctly masking the comparison to include the $r_0 = 0$ case.

Affected products

  • cryspen libcrux-ml-dsa < 0.0.9

Timeline

  • 2026-04-02: other: Similar issue identified in Tink-Go implementation
  • 2026-05-05: other: Fix submitted to libcrux repository
  • 2026-05-19: advisory: GitHub Advisory published
  • 2026-05-19: patched: Fixed in version 0.0.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.