What is GHSA-753P-WRJ5-G8FJ?

GHSA-753P-WRJ5-G8FJ is a high-severity security vulnerability in pqcrypto-hqc (rust), affecting versions < 0.2.1. It is fixed in 0.2.1.

Which versions of pqcrypto-hqc are affected by GHSA-753P-WRJ5-G8FJ?

pqcrypto-hqc (rust) versions < 0.2.1 is affected.

Is there a fix for GHSA-753P-WRJ5-G8FJ?

Yes. GHSA-753P-WRJ5-G8FJ is fixed in 0.2.1. Upgrade to this version or later.

Is GHSA-753P-WRJ5-G8FJ exploitable, and should I be worried?

Whether GHSA-753P-WRJ5-G8FJ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-753P-WRJ5-G8FJ is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix GHSA-753P-WRJ5-G8FJ?

Upgrade pqcrypto-hqc to 0.2.1 or later.

GHSA-753P-WRJ5-G8FJ in pqcrypto-hqc

Q: Which versions of pqcrypto-hqc are affected by GHSA-753P-WRJ5-G8FJ?

pqcrypto-hqc (rust) versions < 0.2.1 is affected.

Q: Is there a fix for GHSA-753P-WRJ5-G8FJ?

Yes. GHSA-753P-WRJ5-G8FJ is fixed in 0.2.1. Upgrade to this version or later.

Q: Is GHSA-753P-WRJ5-G8FJ exploitable, and should I be worried?

Whether GHSA-753P-WRJ5-G8FJ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-753P-WRJ5-G8FJ is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-753P-WRJ5-G8FJ?

Upgrade pqcrypto-hqc to 0.2.1 or later.

Summary

PQClean has a correctness error in HQC decapsulation

Workarounds

Manually patching is always possible

Further details

In the 2023/04/30 version of the HQC specification and reference implementation, an extra field (sigma) was added to the secret key structure to enable implicit rejection of malformed ciphertexts. The logic to retrieve the public key from the secret key in the decapsulation function was not updated accordingly. As a result, sigma is treated as part of the public key. Later in the decapsulation call, a incorrectly constructed comparison check allows this error to go through undetected. Due to how these two bugs interfere with each other, the decapsulation function never uses sigma to perform implicit rejection; instead, it accepts malformed ciphertexts and returns shared secrets based on their decryptions.

References

This issue was first reported in OQS https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7. The vulnerability was identified by Célian Glénaz and Dahmun Goudarzi (Quarkslab).

Impact

A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext.

No concrete attack exploiting the error has been identified at this point. However, the error involves mishandling of the secret key, and in principle this presents a security vulnerability.

Affected versions

pqcrypto-hqc (< 0.2.1)

Security releases

pqcrypto-hqc → 0.2.1 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

PQClean does not have a release process, as it is a collection of implementations. If you obtained a HQC implementation from PQClean, please update to a version that includes the fixes proposed in https://github.com/PQClean/PQClean/pull/578.

Please also refer to our security policy.

Frequently Asked Questions

What is GHSA-753P-WRJ5-G8FJ? GHSA-753P-WRJ5-G8FJ is a high-severity security vulnerability in pqcrypto-hqc (rust), affecting versions < 0.2.1. It is fixed in 0.2.1.
Which versions of pqcrypto-hqc are affected by GHSA-753P-WRJ5-G8FJ? pqcrypto-hqc (rust) versions < 0.2.1 is affected.
Is there a fix for GHSA-753P-WRJ5-G8FJ? Yes. GHSA-753P-WRJ5-G8FJ is fixed in 0.2.1. Upgrade to this version or later.
Is GHSA-753P-WRJ5-G8FJ exploitable, and should I be worried? Whether GHSA-753P-WRJ5-G8FJ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-753P-WRJ5-G8FJ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-753P-WRJ5-G8FJ? Upgrade pqcrypto-hqc to 0.2.1 or later.