Design Flaw in liboqs Affecting Post-Quantum Cryptography Algorithm

CVE-2025-48946

What is CVE-2025-48946?

The liboqs cryptographic library contains a design flaw within its implementation of the HQC algorithm, leading to large numbers of malformed ciphertexts that can share the same implicit rejection value. Although no concrete attacks on this flaw are known, it presents potential risks for implementations involving key derivation. Users are advised that HQC does not offer the same security assurances as alternative algorithms like Kyber or ML-KEM. From version 0.13.0 onwards, HQC is disabled by default in liboqs until an updated algorithm specification is provided by the HQC team.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References