5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24850

CVE-2026-24850: ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated (duplicate) hint indices. According to the ML-DSA specification (FIPS 204 / RFC 9881), hint indices within each polynomial must be strictly increasing. The current implementation uses a non-strict monotonic check (<= instead of <), allowing duplicate indices. This is a regression bug. The original implementation was correct, but a commit in version 0.0.4 inadvertently changed the strict < comparison to <=, introducing the vulnerability. Version 0.1.0-rc.4 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24850

CVE-2026-24850:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ml-dsa	rust	>= 0.0.4, < 0.1.0-rc.4	0.1.0-rc.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a regression bug in the ml-dsa crate, which allows for signature malleability in ML-DSA signature verification. The root cause is in the ml_dsa::hint::monotonic helper function, where a check for strictly increasing hint indices (<) was incorrectly changed to a non-strict check (<=) in commit b01c3b73dd08d0094e089aa234f78b6089ec1f38. This allows an attacker to create multiple valid signatures for the same message by duplicating hint indices, which violates the ML-DSA specification (FIPS 204).

The monotonic function is called by ml_dsa::hint::Hint::bit_unpack when parsing the signature. Therefore, bit_unpack is the function that directly processes the malformed signature component. An exploit would involve crafting a signature with repeated hint indices and submitting it for verification, which would pass through Hint::bit_unpack and be incorrectly validated by monotonic. The fix, implemented in commit 400961412be2e2ab787942cf30e0a9b66b37a54a, removes the monotonic function and replaces its calls inside bit_unpack with an inlined, correct check (<) for the hint indices.

Vulnerable functions

ml_dsa::hint::monotonic

ml-dsa/src/hint.rs

This helper function incorrectly uses a non-strict less-than-or-equal-to (`<=`) comparison to check if hint indices are monotonic. The ML-DSA specification requires indices to be strictly increasing (`<`). This flaw allows signatures with repeated hint indices to be considered valid, leading to signature malleability. The bug was introduced in commit b01c3b7.

ml_dsa::hint::Hint::bit_unpack

ml-dsa/src/hint.rs

This function is responsible for unpacking and validating the hint portion of an ML-DSA signature. It calls the vulnerable `monotonic` function to check the hint indices. By calling the flawed helper function, `bit_unpack` accepts non-compliant signatures, making it the entry point for the vulnerability within the hint processing logic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.