What’s Vulnerable › Vulnerabilities

CVE-2025-52473: liboqs secret-dependent branching in HQC reference implementation when compiled with Clang 17-20

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-10 · updated 2026-06-17
• Weakness: CWE-200

Description

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have been identified in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 (-O1, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key. This vulnerability is fixed in 0.14.0.

Affected products

• open-quantum-safe liboqs: before 0.14.0 — fixed in 0.14.0

How to fix

Upgrade to a fixed version: open-quantum-safe liboqs 0.14.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-quantum-safe/liboqs/commit/4215362acbf69b88fe1777c4c052f154e29f9897
• https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm

Get alerted when CVE-2025-52473 or the next vulnerability affects your stack