CVE-2026-104254: Security vulnerability
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQSENABLESIGSTFLLMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQSSIGSTFLverify or OQSSIGSTFLalglmsverify. In hssvalidatesignatureinit() in src/sigstfl/lms/external/hssverifyinc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, ishsspublickey() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
liboqsto a version that resolves this vulnerability.Fixed in 0.17.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use liboqs versions 0.11.0 through 0.16.0 and were built with OQS_ENABLE_SIG_STFL_LMS=ON. The vulnerable paths are LMS or HSS-LMS signature verification through OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify.
What does an attacker need to trigger the issue?
An attacker needs to supply a truncated, untrusted LMS or HSS-LMS signature to a reachable verification operation, along with a syntactically plausible public key. A valid signature is not required.
Is memory disclosure or signature forgery expected?
No. The out-of-bounds data is used only in an internal hash and is not exposed; the supported impact is a verifier crash and denial of service, not disclosure or acceptance of an invalid signature.
What should teams do if they cannot update immediately?
Avoid passing untrusted LMS or HSS-LMS signatures to the affected verification APIs, or ensure signatures are length-validated before verification. The issue is scheduled to be fixed in version 0.17.0.