GHSA-cp57-fq8g-qh6v Incorrect Check of Signer Response Norm During Verification
The library incorrectly verifies ML-DSA signatures, allowing attackers to bypass signature validation checks and accept invalid signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-cp57-fq8g-qh6v?
GHSA-cp57-fq8g-qh6v is a vulnerability in libcrux-ml-dsa, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ML-DSA verification algorithm as specified in FIPS 204, subsection 6.3 requires verifiers to check that the infinity norm of the deserialized signer response $z$ does not exceed $\gamma_1 - \beta$ (line 13 of Algorithm 8). The same check is required to be performed during signature generation.
libcrux-ml-dsa did not perform this check correctly during signature verification, accepting signatures with signer response norm above the allowed maximum value. The check is correctly performed during signing.
Impact
Applications using libcrux-ml-dsa for signature verification would have accepted signatures that would be rejected by a conforming implementation.
Mitigation
Starting from version 0.0.8, signature verification uses the correct
value for $\gamma_1$ in the signer response norm check.
Which versions are affected by GHSA-cp57-fq8g-qh6v?
3 open source packages ship an affected version, including libcrux-ml-dsa.
| Package | Affected | Fixed in |
|---|---|---|
libcrux-ml-dsa crates.io | All versions | 0.0.8 |
libcrux-ml-dsa crates.io | All versions | 0.0.8 |
libcrux-ml-dsa crates.io | From 0.0.0-0 | 0.0.8 |
How do I fix GHSA-cp57-fq8g-qh6v?
Upgrade libcrux-ml-dsa to 0.0.8 or later.
Is GHSA-cp57-fq8g-qh6v being exploited?
There is no known exploitation of GHSA-cp57-fq8g-qh6v in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0077.