Open Quantum Safe disclosures

// Security advisories & upstream fixes

GHSA-xv6c-h66p-6mfq

liboqs LMS verification accepts signatures from another parameter set

LMS verification did not bind the signature and public key to the parameter set of the object in use. Reported publicly in issue #2568 and credited as an independent report in the joint advisory; CVE-2026-104255 assigned.

Co-credited CVE.org ↗GHSA ↗ Details →

PR #766

oqs-provider double-free in signature handling

Double-free vulnerability in oqs-provider. Fix contributed as upstream PR #766, merged and credited.

Fix authored PR #766 ↗ Details →

PR #767

oqs-provider NULL-check hardening

Duplicate NULL-check correction in oqsx_get_hybrid_params(). Fix contributed as upstream PR #767, merged and credited.

Fix authored PR #767 ↗ Details →

All disclosures →

Open Quantum Safe.

// Security advisories & upstream fixes

liboqs LMS verification accepts signatures from another parameter set

oqs-provider double-free in signature handling

oqs-provider NULL-check hardening