Vulnerability · Published May 30, 2025 · Assigned by GitHub_M
CVE-2025-48946liboqs affected by theoretical design flaw in HQC
Low 3.7
In plain English
A low-severity broken cryptography in liboqs from open-quantum-safe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when using the algorithm in protocols involving key derivation. In particular, HQC does not provide the same security guarantees as Kyber or ML-KEM. There is currently no patch for the HQC flaw available in liboqs, so HQC is disabled by default in liboqs starting from version 0.13.0. OQS will update its implementation after the HQC team releases an updated algorithm specification.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-quantum-safe | liboqs | < 0.13.0 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-3rxw-4v8q-9gq5 x_refsource_CONFIRM
- https://github.com/open-quantum-safe/liboqs/commit/a7d698ca9c9d98990647459253183cbe29c550af x_refsource_MISC
- https://durumcrustulum.com/2024/02/24/how-to-hold-kems/#hqc x_refsource_MISC
- https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Wiu4ZQo3fP80 x_refsource_MISC