CVE-2026-24850 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices
Attackers can bypass signature verification in the ML-DSA Rust library by submitting signatures with duplicate hint indices, violating FIPS 204 standards.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24850?
CVE-2026-24850 is a medium-severity vulnerability in RustCrypto signatures, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto `ml-dsa` crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be **strictly increasing**. The current implementation uses a non-strict monotonic check (`<=` instead of `<`), allowing duplicate indices. This is a regression bug. The original implementation was correct, but a commit in version 0.0.4 inadvertently changed the strict `<` comparison to `<=`, introducing the vulnerability. Version 0.1.0-rc.4 fixes the issue.
Weakness: CWE-347
Which versions are affected by CVE-2026-24850?
2 open source packages ship an affected version, including ml-dsa.
| Package | Affected | Fixed in |
|---|---|---|
ml-dsa crates.io | From 0.0.4 | 0.1.0-rc.4 |
ml-dsa crates.io | From 0.0.4 | 0.1.0-rc.4 |
How do I fix CVE-2026-24850?
Upgrade ml-dsa to 0.1.0-rc.4 or later.
Is CVE-2026-24850 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24850 exists.
Sources
Also known as GHSA-5x2r-hc65-25f9.