CVE-2026-24850

The record

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto `ml-dsa` crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be **strictly increasing**. The current implementation uses a non-strict monotonic check (`<=` instead of `<`), allowing duplicate indices. This is a regression bug. The original implementation was correct, but a commit in version 0.0.4 inadvertently changed the strict `<` comparison to `<=`, introducing the vulnerability. Version 0.1.0-rc.4 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-5x2r-hc65-25f9 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices Same vulnerability
• GHSA-h37v-hp6w-2pp8 ml-dsa's UseHint function has off by two error when r0 equals zero Also affects ml-dsa
• CVE-2026-22705 RustCrypto: Signatures offers support for digital signatures, which provide… Also affects ml-dsa
• RUSTSEC-2025-0144 Timing side-channel in ML-DSA decomposition Also affects ml-dsa
• CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
• CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347
• CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
• CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. CWE-347