{"id":"EUVD-2026-1867","enisaUuid":"2545fc4f-a717-3a40-a253-5a1dcb19fe92","description":"RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.","datePublished":"Jan 10, 2026, 6:14:20 AM","dateUpdated":"Jan 12, 2026, 4:43:06 PM","baseScore":6.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7\nhttps://github.com/RustCrypto/signatures/pull/1144\nhttps://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558\n","aliases":"CVE-2026-22705\nGHSA-hcp2-x6j4-29j7\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"f7fd9c7a-09cd-33d9-b221-df2b7bec3b46","product":{"name":"signatures","vendor":{"name":"RustCrypto"}},"product_version":"\u003c 0.1.0-rc.2"}],"enisaIdVendor":[{"id":"8fbb2bf7-73d5-301d-89f7-54fc6d5db048","vendor":{"name":"RustCrypto"}}],"enisaIdVulnerability":[{"id":"3b3aeadd-38a6-3f28-9a8d-1a8b6d81160b","vulnerability":{"id":"CVE-2026-22705","description":"RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.","datePublished":"Jan 10, 2026, 6:14:20 AM","dateUpdated":"Jan 12, 2026, 4:43:06 PM","status":"PUBLISHED","baseScore":6.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7\nhttps://github.com/RustCrypto/signatures/pull/1144\nhttps://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558\n","enisa_id":"EUVD-2026-1867\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Oct 27, 2026, 7:19:40 AM","vulnerabilityProduct":[{"id":"fd7af201-7f00-37eb-b43b-258b051755e9","product":{"name":"signatures","vendor":{"name":"RustCrypto"}},"product_version":"\u003c 0.1.0-rc.2"}],"vulnerabilityVendor":[{"id":"0a9c24d4-c470-3c6d-bf77-d134d7389ada","vendor":{"name":"RustCrypto"}}]}},{"id":"633488bf-42f9-3f3e-8c79-c68b42542b3f","vulnerability":{"id":"GHSA-hcp2-x6j4-29j7","description":"RustCrypto: Signatures has timing side-channel in ML-DSA decomposition","datePublished":"Jan 13, 2026, 3:10:03 PM","dateUpdated":"Apr 24, 2026, 7:58:16 PM","baseScore":0.0,"references":"https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22705\nhttps://github.com/RustCrypto/signatures/pull/1144\nhttps://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558\nhttps://github.com/RustCrypto/signatures\nhttps://rustsec.org/advisories/RUSTSEC-2025-0144.html\n","enisa_id":"EUVD-2026-1867\n","aliases":"CVE-2026-22705\nGHSA-hcp2-x6j4-29j7\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:53:13 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}