Timing Side-Channel Vulnerability in RustCrypto Signatures Affects Public-Key Authentication
CVE-2026-22705

6.4MEDIUM

Key Information:

Vendor

Rustcrypto

Status
Signatures
Vendor
CVE Published:
10 January 2026

What is CVE-2026-22705?

A vulnerability was identified in the RustCrypto Signatures library, specifically in the Decompose algorithm used during Machine Learning (ML)-DSA signing. This timing side-channel could potentially allow attackers to infer sensitive information by analyzing the time taken to perform cryptographic operations. The issue was addressed in version 0.1.0-rc.2, which contains patches to mitigate the risk associated with this vulnerability.

Affected Version(s)

signatures < 0.1.0-rc.2

References

https://github.com/RustCrypto/signatures/security/advisor...
x_refsource_CONFIRM
https://github.com/RustCrypto/signatures/pull/1144
x_refsource_MISC
https://github.com/RustCrypto/signatures/commit/035d9eef9...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.