CVE-2025-48946

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when using the algorithm in protocols involving key derivation. In particular, HQC does not provide the same security guarantees as Kyber or ML-KEM. There is currently no patch for the HQC flaw available in liboqs, so HQC is disabled by default in liboqs starting from version 0.13.0. OQS will update its implementation after the HQC team releases an updated algorithm specification.

• CWE-327

• https://durumcrustulum.com/2024/02/24/how-to-hold-kems/#hqcProduct
• https://github.com/open-quantum-safe/liboqs/commit/a7d698ca9c9d98990647459253183cbe29c550afPatch
• https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-3rxw-4v8q-9gq5Vendor Advisory
• https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Wiu4ZQo3fP80Issue Tracking, Mailing List

Published

May 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48940MyBB is free and open source forum software. Prior to versio…7.2
• CVE-2025-48941MyBB is free and open source forum software. Prior to versio…5.3
• CVE-2025-48942vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48943vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48944vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48945pycares is a Python module which provides an interface to c-…8.2
• CVE-2025-48947The Auth0 Next.js SDK is a library for implementing user aut…7.7
• CVE-2025-48948Navidrome is an open source web-based music collection serve…6.5
• CVE-2025-48949Navidrome is an open source web-based music collection serve…9.8
• CVE-2025-4895A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-48950MaxKB is an open-source AI assistant for enterprise. Prior t…8.8
• CVE-2025-48951Auth0-PHP is a PHP SDK for Auth0 Authentication and Manageme…9.3