Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0126

AVX2 Implementation Did Not Fully Reduce Intermediate Values

Published Apr 27, 2026 · Updated May 13, 2026 · Assigned by RUSTSEC

Description

The AVX2 implementation of ML-DSA did not fully reduce intermediate
inputs to the inverse NTT, which leads to a testable difference in
panic behaviour of internal functions compared to the portable
implementation.

## Impact
We are not aware of inputs to the public key generation, signing or
verification APIs that trigger a panic in the AVX2 implementation
because the intermediate values were not fully reduced.

## Mitigation
From version `0.0.9` intermediate values on AVX2 platforms are fully
reduced in alignment with the portable implementation.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io libcrux-ml-dsa >= 0.0.0-0, < 0.0.9 0.0.9 RUSTSEC-2026-0126

References