RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-22705 · Microsoft / collected KEV context

EUVD-2026-1867

GHSA-hcp2-x6j4-29j7

RUSTSEC-2025-0144

cve-program · CVE-2026-22705

• https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7
• https://github.com/RustCrypto/signatures/pull/1144
• https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558

euvd · EUVD-2026-1867

• https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7
• https://github.com/RustCrypto/signatures/pull/1144
• https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558

nvd · CVE-2026-22705

• https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558
• https://github.com/RustCrypto/signatures/pull/1144
• https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7

osv · GHSA-hcp2-x6j4-29j7

• https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7
• https://nvd.nist.gov/vuln/detail/CVE-2026-22705
• https://github.com/RustCrypto/signatures/pull/1144
• https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558
• https://github.com/RustCrypto/signatures
• https://rustsec.org/advisories/RUSTSEC-2025-0144.html

osv · RUSTSEC-2025-0144

• https://crates.io/crates/ml-dsa
• https://rustsec.org/advisories/RUSTSEC-2025-0144.html
• https://github.com/RustCrypto/signatures/pull/1144

No related operational record is retained in the current change model.