CVE-2025-48946 in liboqs
Summary
by MITRE • 05/30/2025
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when using the algorithm in protocols involving key derivation. In particular, HQC does not provide the same security guarantees as Kyber or ML-KEM. There is currently no patch for the HQC flaw available in liboqs, so HQC is disabled by default in liboqs starting from version 0.13.0. OQS will update its implementation after the HQC team releases an updated algorithm specification.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/02/2025
The vulnerability identified as CVE-2025-48946 pertains to a fundamental design flaw in the HQC (HQC: Hash-based Quantum-safe Cryptography) algorithm implementation within the liboqs cryptographic library. This issue affects versions prior to 0.13.0 where the HQC algorithm suffers from a theoretical weakness that manifests through malformed ciphertexts sharing identical implicit rejection values. The flaw represents a significant concern for cryptographic security as it undermines the algorithm's reliability in post-quantum cryptographic applications, despite the absence of known concrete attacks that exploit this weakness. The vulnerability falls under the category of cryptographic algorithmic weaknesses and can be classified as a CWE-310 (Cryptographic Algorithm Weakness) according to the Common Weakness Enumeration framework.
The technical flaw in the HQC algorithm stems from its mathematical design that allows for a large number of malformed ciphertexts to produce the same implicit rejection value during the decryption process. This characteristic creates potential vulnerabilities in key derivation protocols where the consistency of rejection values is crucial for maintaining cryptographic security guarantees. The algorithm's behavior creates a scenario where an attacker could potentially exploit the predictable nature of these rejection values to gain information about the cryptographic keys or the underlying protocol implementation. This weakness particularly impacts the algorithm's suitability for use in security-critical applications where strong cryptographic guarantees are required.
The operational impact of this vulnerability extends beyond immediate security concerns to affect the broader adoption and trust in post-quantum cryptographic solutions. Organizations and developers relying on liboqs for quantum-safe cryptography implementations must recognize that the HQC algorithm does not provide the same security assurances as more mature post-quantum candidates such as Kyber or ML-KEM. The vulnerability's implications are particularly severe in environments where key derivation protocols are employed, as the shared rejection values could potentially leak information about the cryptographic operations or compromise the security of derived keys. This limitation forces implementers to either avoid the algorithm entirely or implement additional security measures to compensate for the inherent weakness.
The remediation approach taken by the liboqs development team represents a prudent security measure that aligns with the principle of least privilege and defensive programming. Starting from version 0.13.0, the HQC algorithm has been disabled by default, preventing accidental use of the flawed implementation in new deployments. This approach follows the ATT&CK framework's recommendation for mitigating cryptographic vulnerabilities through configuration changes and default security settings. The decision to disable the algorithm reflects the security community's consensus that the theoretical flaw poses sufficient risk to warrant proactive mitigation, even in the absence of demonstrated exploitation. The library developers have also committed to updating their implementation once the HQC team releases an updated algorithm specification, demonstrating a responsible approach to vulnerability management that prioritizes long-term security over immediate functionality. This strategy ensures that when the underlying algorithm is corrected, the library can be updated to provide the enhanced security that users expect from cryptographic implementations.