{"id":"CVE-2026-22705","aliases":["RUSTSEC-2025-0144","GHSA-hcp2-x6j4-29j7"],"title":"Timing side-channel in ML-DSA decomposition","summary":"Timing side-channel in ML-DSA decomposition","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","vendor":"ml-dsa","product":"ml-dsa","ecosystem":"rust","affected":["ml-dsa >= 0.0.0-0, < 0.1.0-rc.3"],"patched":["ml-dsa 0.1.0-rc.3"],"published":"2025-12-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:13.061349808Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0144","references":[{"url":"https://crates.io/crates/ml-dsa"},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0144.html"},{"url":"https://github.com/RustCrypto/signatures/pull/1144"}],"tags":["osv","rust"],"epss":0.00163,"epssPercentile":0.05024,"ingestedAt":"2026-10-13T11:45:30.182Z","slug":"CVE-2026-22705","body":"## Overview\n\n### Summary\n\nA timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.\n\n### Details\n\nThe analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:\n\n- **UDIV/SDIV instructions**: Hardware division instructions have early termination optimizations where execution time depends on operand values.\n\nThe `decompose` function used a hardware division instruction to compute `r1.0 / TwoGamma2::U32`. This function is called during signing through `high_bits()` and `low_bits()`, which process values derived from secret key components:\n\n- `(&w - &cs2).low_bits()` where `cs2` is derived from secret key component `s2`\n- `Hint::new()` calls `high_bits()` on values derived from secret key component `t0`\n\n**Original Code**:\n```rust\nfn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {\n    // ...\n    let mut r1 = r_plus - r0;\n    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data\n    (r1, r0)\n}\n```\n\n### Impact\n\nThe dividend (`r1.0`) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.\n\n### Mitigation\n\nInteger division was replaced with a constant-time Barrett reduction.\n\n## Affected packages\n\n- `ml-dsa >= 0.0.0-0, < 0.1.0-rc.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ml-dsa 0.1.0-rc.3`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}