Liboqs · Liboqs · CVE-2025-48946
**Name of the Vulnerable Software and Affected Versions**
liboqs versions prior to 0.13.0
**Description**
The issue is related to a theoretical design flaw in the HQC algorithm, which is implemented in liboqs. This flaw can lead to large numbers of malformed ciphertexts sharing the same implicit rejection value. Although no concrete attack on the algorithm is currently known, users of HQC must exercise extra caution when using the algorithm in protocols involving key derivation. The HQC algorithm does not provide the same security guarantees as other algorithms like Kyber or ML-KEM.
**Recommendations**
For liboqs versions prior to 0.13.0, consider disabling the HQC algorithm to minimize potential risks until an updated algorithm specification is released by the HQC team and implemented in liboqs.
At the moment, there is no information about a newer version that contains a fix for this vulnerability, but HQC is disabled by default in liboqs starting from version 0.13.0.