Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
RustCrypto’s ML-DSA advisory is a good example (GHSA-hcp2-x6j4-29j7, CVE-2026-22705), discovered by @trailofbits. It is a timing side-channel caused by a variable-time division occurring on secret-influenced data during signing.
Post summary
RustCrypto’s advisory for CVE-2026-22705 discloses a timing side‑channel in ML-DSA caused by variable‑time division during signing.