// Security advisory · Fixed upstream
Double-free vulnerability in oqs-provider. Fix contributed as upstream PR #766, merged and credited.
oqs-provider is the OpenSSL 3 provider that adds post-quantum algorithms from liboqs. OpenSSL 3.4 introduced a signature field in the signature context, and oqs_sig_dupctx() copied the context with a shallow struct copy, so the original and the duplicate shared one heap pointer. Freeing both contexts freed the same block twice.
A double free in a code path OpenSSL exercises whenever a signature context is duplicated. Memory corruption of that kind is a crash at best; the exact reach depends on the allocator and on what the application does between the two frees.
Reported privately to the maintainers with the fix attached. PR #766 clears the field after the shallow copy and deep-copies it with OPENSSL_memdup; ASan-clean on the reproducer. Merged upstream on 13 Apr 2026. The maintainers chose not to request a CVE.
Reported and fixed by Eva Crystal (iiviel / 0xiviel), XSource Security.
Integer underflow of mlen in crypto_sign_open() in the CROSS reference implementation leads to a heap buffer overflow during signature verification.
Insufficient protection of serialized SSL session/context data can lead to memory-safety issues when restoring tampered or corrupted state. Credited jointly with Haruto Kimura (Stella).
FFDH key exchange lacks contributory-behaviour / peer-key validation, enabling protocol-level abuse. Found independently by Eva Crystal (0xiviel).
Out-of-bounds read in mbedtls_ccm_finish(): an oversized tag_len in the multipart CCM API exposes adjacent CCM context data. Discovered through the Intigriti Trusted Firmware program.
