Most recent entries from all

EUVD-2026-266800

fkie_cve-2026-24850

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto `ml-dsa` crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be **strictly increasing**. The current implementation uses a non-strict monotonic check (`<=` instead of `<`), allowing duplicate indices. This is a regression bug. The original implementation was correct, but a commit in version 0.0.4 inadvertently changed the strict `<` comparison to `<=`, introducing the vulnerability. Version 0.1.0-rc.4 fixes the issue.

GHSA-5x2r-hc65-25f9 — ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

Affected: crates.io: ml-dsa

**Affected Crate:** `ml-dsa` **Affected Versions:** v0.1.0-rc.2 (and commits since `b01c3b7`) **Severity:** Medium **Reporter:** Oren Yomtov (Fireblocks)

## Summary

The ML-DSA signature verification implementation in the RustCrypto `ml-dsa` crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be **strictly increasing**. The current implementation uses a non-strict monotonic check (`<=` instead of `<`), allowing duplicate indices.

**Note:** This is a regression bug. The original implementation was correct, but commit `b01c3b7` ("Make ML-DSA signature decoding follow the spec (#895)", fixing issue #894) inadvertently changed the strict `<` comparison to `<=`, introducing the vulnerability.

## Vulnerability Details

### Root Cause

The vulnerability is located in the `monotonic` helper function in `ml-dsa/src/hint.rs`:

```rust fn monotonic(a: &[usize]) -> bool { a.iter().enumerate().all(|(i, x)| i == 0 || a[i - 1] <= *x) } ```

The comparison operator `<=` allows equal consecutive values, meaning duplicate hint indices are not rejected. The correct implementation should use strict less-than (`<`):

```rust fn monotonic(a: &[usize]) -> bool { a.iter().enumerate().all(|(i, x)| i == 0 || a[i - 1] < *x) } ```

### Regression Analysis

- **Original correct code** (commit `1d3a1d1` - "Add support for ML-DSA (#877)"): Used `<` (strict) - **Bu…