CVE-2026-44519
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In liboqs, the ct_select function in the FrodoKEM implementation (AES and SHAKE variants) lacks a value barrier in the Fujisaki-Okamoto implicit-rejection path. When compiled with Clang 17 or later at an optimization level such as -Os, the compiler can emit a secret-dependent conditional load, allowing success and rejection paths to be distinguished by cache residency.
Risk Assessment
A local attacker able to perform repeated cache-timing measurements may use this leak as an oracle in a private-key recovery attack. Default -O3 builds do not exhibit the reported behavior.
Recommendation
Upgrade liboqs to version 0.16.0 or later. If using Clang 17+ with -Os, verify the build configuration after upgrading.
Other vulnerabilities in liboqs
See all- CVE-2026-47738Medium
liboqs prior to 0.16.0 can dereference an uninitialized encaps_derand function pointer in OQS_KEM_encaps_derand for six NTRU schemes (NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, NTRU-HRSS-1373). The affected constructors omit the encaps_derand member and OQS_KEM objects are allocated without zero initialization. An application is affected only if it instantiates one of those six NTRU KEMs and invokes OQS_KEM_encaps_derand on it.
- CVE-2026-104254Medium
In liboqs from 0.11.0 through 0.16.0, builds with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. hss_validate_signature_init() does not ensure the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer, and in 0.16.0 is_hss_public_key() reads at offset 8 after only a four-byte length check.
- CVE-2026-46344Medium
liboqs prior to version 0.16.0 has an out-of-bounds read vulnerability in the XMSS and XMSS^MT signature verification code, potentially leading to a crash (denial of service).
- CVE-2026-44518Medium
In liboqs before 0.16.0, an out-of-bounds read occurs in XMSS/XMSS^MT signature verification when the signature buffer is shorter than expected. The implementation does not validate the length and reads past the buffer, potentially causing a crash (DoS).
Original NVD description (English source)
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ct_select function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barrier in the Fujisaki-Okamoto implicit-rejection path. When compiled with Clang 17 or later at an affected optimization level such as -Os, the compiler can emit a secret-dependent conditional load, causing the real and rejection secret paths to leave distinguishable cache residency after successful and failed decapsulation. A local attacker able to perform repeated cache-timing measurements may use this oracle as part of a private-key recovery attack. Default -O3 builds vectorize both source loads and do not exhibit the reported behavior, and the advisory does not report the same generated memory-access pattern in NTRU, NTRU-Prime, BIKE, HQC, Classic McEliece, Kyber, or the already-barriered ML-KEM implementation. This issue is fixed in version 0.16.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS