GHSA-5x2r-hc65-25f9
Medium · 5.3CVSS
5.3
EPSS
—
Published
Jan 28, 2026
CISA due date
—
The record
ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | ml-dsa | 0.0.4 | 0.1.0-rc.4 |
| cargo | ml-dsa | 0.0.4 | 0.1.0-rc.4 |
Related vulnerabilities
- CVE-2026-24850 The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature… Same vulnerability
- GHSA-h37v-hp6w-2pp8 ml-dsa's UseHint function has off by two error when r0 equals zero Also affects ml-dsa
- CVE-2026-22705 RustCrypto: Signatures offers support for digital signatures, which provide… Also affects ml-dsa
- RUSTSEC-2025-0144 Timing side-channel in ML-DSA decomposition Also affects ml-dsa
- CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
- CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347
- CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. CWE-347