What’s Vulnerable › Vulnerabilities

CVE-2024-54137: liboqs has a correctness error in HQC decapsulation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-06 · updated 2026-06-17
• Weakness: CWE-200

Description

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext. This vulnerability is fixed in 0.12.0.

Affected products

• open-quantum-safe liboqs: before 0.12.0 — fixed in 0.12.0

How to fix

Upgrade to a fixed version: open-quantum-safe liboqs 0.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-quantum-safe/liboqs/commit/cce1bfde4e52c524b087b9687020d283fbde0f24
• https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7

Get alerted when CVE-2024-54137 or the next vulnerability affects your stack