{"id":"CVE-2026-44519","kind":"vulnerability","aliases":["CVE-2026-44519"],"related":[],"title":"liboqs: FrodoKEM decapsulation leaks secrets via cache timing under -Os","description":"liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ct_select function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barrier in the Fujisaki-Okamoto implicit-rejection path. When compiled with Clang 17 or later at an affected optimization level such as -Os, the compiler can emit a secret-dependent conditional load, causing the real and rejection secret paths to leave distinguishable cache residency after successful and failed decapsulation. A local attacker able to perform repeated cache-timing measurements may use this oracle as part of a private-key recovery attack. Default -O3 builds vectorize both source loads and do not exhibit the reported behavior, and the advisory does not report the same generated memory-access pattern in NTRU, NTRU-Prime, BIKE, HQC, Classic McEliece, Kyber, or the already-barriered ML-KEM implementation. This issue is fixed in version 0.16.0.","summary":"liboqs, a C post-quantum cryptography library, has a missing value barrier in its FrodoKEM ct_select routine that Clang 17+ can compile into a secret-dependent memory access at -Os. A local attacker running repeated cache-timing measurements can use this as an oracle toward private-key recovery.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","clang","liboqs","package","post-quantum"],"not_affected_if":["default-o3-build","liboqs-0.16.0-or-later","no-frodokem"],"how_to_check":"- Check the liboqs version your build links against, for example `liboqs` in your package manifest or `oqs_version()`.\n- Check whether you build FrodoKEM with Clang 17 or later at `-Os` rather than the default `-O3`.","fix":"- liboqs: move to `0.16.0` or later.","status":"open","published_at":"2026-11-06T22:17:51+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","triaged_at":"2026-11-06T22:44:59+00:00","updated_at":"2026-11-06T22:44:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T22:44:59Z","model":"claude-haiku-5-5","output":{"fix":"- liboqs: move to `0.16.0` or later.","reach":"local","title":"liboqs: FrodoKEM decapsulation leaks secrets via cache timing under -Os","impact":"high","summary":"liboqs, a C post-quantum cryptography library, has a missing value barrier in its FrodoKEM ct_select routine that Clang 17+ can compile into a secret-dependent memory access at -Os. A local attacker running repeated cache-timing measurements can use this as an oracle toward private-key recovery.","audience":"developers","category":"package","nicknames":[],"who_cares":["liboqs","post-quantum","c","clang"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"local attacker may aid private-key recovery via cache timing","analyst_note":"","how_to_check":"- Check the liboqs version your build links against, for example `liboqs` in your package manifest or `oqs_version()`.\n- Check whether you build FrodoKEM with Clang 17 or later at `-Os` rather than the default `-O3`.","plain_action":"","needs_analyst":false,"not_affected_if":["default-o3-build","no-frodokem","liboqs-0.16.0-or-later"],"who_is_affected":"Only builds that include liboqs FrodoKEM (AES or SHAKE variants) before 0.16.0, compiled with Clang 17 or later at an optimization level such as -Os. Default -O3 builds vectorize the affected loads and are reported as not exhibiting the behavior. Other liboqs KEMs named in the advisory are not reported as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4551,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1344':111C '-2026':12A,15A '-44519':13A,16A '-640':106C '-976':108C '0.16.0':96C,248C '17':45B,134C 'abl':175C 'access':54B,221C 'advisori':212C 'ae':112C 'affect':139C 'algorithm':93C 'alreadi':236C 'already-barri':235C 'attack':59B,174C,195C 'barrier':36B,120C,237C 'behavior':209C 'bike':228C 'build':198C 'c':17B,26B,81C 'c-languag':80C 'cach':7A,63B,165C,180C 'cache-tim':62B,179C 'caus':155C 'clang':18B,44B,133C 'classic':230C 'compil':47B,131C,146C 'condit':153C 'cryptograph':83C 'cryptographi':30B,92C 'ct':40B,98C 'cve':11A,14A 'decapsul':3A,171C 'default':196C 'depend':52B,152C 'distinguish':164C 'emit':148C 'exhibit':206C 'fail':170C 'fix':245C 'frodokem':2A,39B,105C,107C,110C 'fujisaki':124C 'fujisaki-okamoto':123C 'function':100C 'generat':218C 'hqc':229C 'implement':87C,241C 'implicit':127C 'implicit-reject':126C 'issu':243C 'kem':240C 'key':75B,193C 'kyber':232C 'lack':117C 'languag':82C 'later':136C 'leak':4A 'leav':163C 'level':141C 'liboq':1A,19B,24B,77C 'librari':31B,84C 'load':154C,202C 'local':58B,173C 'may':183C 'mceliec':231C 'measur':65B,182C 'memori':53B,220C 'memory-access':219C 'miss':34B 'ml':239C 'ml-kem':238C 'ntru':224C,226C 'ntru-prim':225C 'o3':197C 'okamoto':125C 'optim':140C 'oracl':71B,186C 'os':10A,56B,144C 'packag':20B 'part':188C 'path':129C,161C 'pattern':222C 'perform':177C 'post':22B,28B,90C 'post-quantum':21B,27B,89C 'prime':227C 'prior':94C 'privat':74B,192C 'private-key':73B,191C 'provid':86C 'quantum':23B,29B,91C 'real':157C 'recoveri':76B,194C 'refer':115C 'reject':128C,159C 'repeat':61B,178C 'report':208C,215C 'resid':166C 'routin':42B 'run':60B 'secret':5A,51B,151C,160C 'secret-depend':50B,150C 'select':41B,99C 'shake':114C 'sourc':201C 'src/kem/frodokem/external/util.c':102C 'success':168C 'time':8A,64B,181C 'toward':72B 'use':67B,184C 'valu':35B,119C 'variant':116C 'vector':199C 'version':247C 'via':6A","nicknames":[],"mitigations":[],"who_affected":"Only builds that include liboqs FrodoKEM (AES or SHAKE variants) before 0.16.0, compiled with Clang 17 or later at an optimization level such as -Os. Default -O3 builds vectorize the affected loads and are reported as not exhibiting the behavior. Other liboqs KEMs named in the advisory are not reported as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","clang","liboqs","medium","package","postquantum"],"campaign_type":null,"search_a":"'-2026':12A,15A '-44519':13A,16A 'cach':7A 'cve':11A,14A 'decapsul':3A 'frodokem':2A 'leak':4A 'liboq':1A 'os':10A 'secret':5A 'time':8A 'via':6A","search_b":"'17':45B 'access':54B 'attack':59B 'barrier':36B 'c':17B,26B 'cach':63B 'cache-tim':62B 'clang':18B,44B 'compil':47B 'cryptographi':30B 'ct':40B 'depend':52B 'frodokem':39B 'key':75B 'liboq':19B,24B 'librari':31B 'local':58B 'measur':65B 'memori':53B 'miss':34B 'oracl':71B 'os':56B 'packag':20B 'post':22B,28B 'post-quantum':21B,27B 'privat':74B 'private-key':73B 'quantum':23B,29B 'recoveri':76B 'repeat':61B 'routin':42B 'run':60B 'secret':51B 'secret-depend':50B 'select':41B 'time':64B 'toward':72B 'use':67B 'valu':35B","search_c":"'-1344':111C '-640':106C '-976':108C '0.16.0':96C,248C '17':134C 'abl':175C 'access':221C 'advisori':212C 'ae':112C 'affect':139C 'algorithm':93C 'alreadi':236C 'already-barri':235C 'attack':174C,195C 'barrier':120C,237C 'behavior':209C 'bike':228C 'build':198C 'c':81C 'c-languag':80C 'cach':165C,180C 'cache-tim':179C 'caus':155C 'clang':133C 'classic':230C 'compil':131C,146C 'condit':153C 'cryptograph':83C 'cryptographi':92C 'ct':98C 'decapsul':171C 'default':196C 'depend':152C 'distinguish':164C 'emit':148C 'exhibit':206C 'fail':170C 'fix':245C 'frodokem':105C,107C,110C 'fujisaki':124C 'fujisaki-okamoto':123C 'function':100C 'generat':218C 'hqc':229C 'implement':87C,241C 'implicit':127C 'implicit-reject':126C 'issu':243C 'kem':240C 'key':193C 'kyber':232C 'lack':117C 'languag':82C 'later':136C 'leav':163C 'level':141C 'liboq':77C 'librari':84C 'load':154C,202C 'local':173C 'may':183C 'mceliec':231C 'measur':182C 'memori':220C 'memory-access':219C 'ml':239C 'ml-kem':238C 'ntru':224C,226C 'ntru-prim':225C 'o3':197C 'okamoto':125C 'optim':140C 'oracl':186C 'os':144C 'part':188C 'path':129C,161C 'pattern':222C 'perform':177C 'post':90C 'post-quantum':89C 'prime':227C 'prior':94C 'privat':192C 'private-key':191C 'provid':86C 'quantum':91C 'real':157C 'recoveri':194C 'refer':115C 'reject':128C,159C 'repeat':178C 'report':208C,215C 'resid':166C 'secret':151C,160C 'secret-depend':150C 'select':99C 'shake':114C 'sourc':201C 'src/kem/frodokem/external/util.c':102C 'success':168C 'time':181C 'use':184C 'valu':119C 'variant':116C 'vector':199C 'version':247C","first_public_at":"2026-11-02T14:56:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-44519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44519","severity":null,"published_at":"2026-11-06T22:17:51+00:00","modified_at":"2026-11-06T22:17:51+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","fetched_at":"2026-11-06T22:44:32+00:00","note":null}],"documents":[{"id":90741,"url":"https://github.com/open-quantum-safe/liboqs/commit/d95fc734f5de9bdfc80c8c65d8166b30e9cff5cd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90742,"url":"https://github.com/open-quantum-safe/liboqs/releases/tag/0.16.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90743,"url":"https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-5c97-hp95-vg56","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T14:56:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}