Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 30 October 2026.

Which products and versions are affected?

orion (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.17.16,introduced=0.18.0-0,fixed=0.18.1; Orion before 0.17.16, 0.18.0 before 0.18.1.

Is there a fix for This vulnerability?

Yes. orion (crates.io): upgrade to 0.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked from the adjacent network or with local access, in a software library.

Check whether you run orion (crates.io) or Orion at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Orion cryptographic library timing vulnerability in ML-KEM and ML-DSA

Severity: info · Published 2026-10-30

Orion is a Rust cryptographic library that implements the ML-KEM key encapsulation and ML-DSA signature algorithms. On certain processor architectures (x86, x86_64, and s390x), LLVM compiler optimizations introduce timing variations into operations that are supposed to execute in constant time, potentially allowing attackers to recover cryptographic keys through timing analysis attacks.

Technologies: orion (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 30 October 2026.
Which products and versions are affected?: orion (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.17.16,introduced=0.18.0-0,fixed=0.18.1; Orion before 0.17.16, 0.18.0 before 0.18.1.
Is there a fix for This vulnerability?: Yes. orion (crates.io): upgrade to 0.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked from the adjacent network or with local access, in a software library.
Am I affected?: Check whether you run orion (crates.io) or Orion at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

orion (crates.io): upgrade to 0.18.1 or later
```
cargo update -p orion
```

Technical details

The vulnerability occurs when LLVM compiles the conditional_sub_u32() function used in field arithmetic for both ML-KEM and ML-DSA. On targets without conditional move/select instructions, the compiler generates variable-time code with conditional jumps dependent on secret data. An attacker with timing measurement capability could exploit this leakage to recover encapsulation and signing keys, though the practicality depends on compiler, target CPU, and attacker proximity to the process.

Affected products

Orion orion before 0.17.16, 0.18.0 before 0.18.1

Identifiers

GHSA-r7wm-4vf2-h44w
RUSTSEC-2026-0426

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.