Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0160

`pqcrypto-sphincsplus` is unmaintained: upstream PQClean project being archived

Published Jun 4, 2026 · Updated Jun 4, 2026 · Assigned by RUSTSEC

Description

This crate provides Rust bindings to SPHINCS+/SLH-DSA (FIPS 205) via C
implementations from [PQClean](https://github.com/PQClean/PQClean). The
PQClean project is being archived in or after July 2026 (see
[PQClean/PQClean#604](https://github.com/PQClean/PQClean/issues/604)),
after which no further security patches or bug fixes will be applied to the
upstream implementations.

As a result, this crate will no longer receive updates. Users should migrate
to the [`slh-dsa`](https://crates.io/crates/slh-dsa) crate, which provides a
pure-Rust implementation of SLH-DSA (FIPS 205).

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io pqcrypto-sphincsplus >= 0.0.0-0 — RUSTSEC-2026-0160

References