CVE-2024-37305: Open-Quantum-Safe Oqs-Provider

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODE_UINT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. Unchecked length values are later used for memory reads and writes; malformed input can lead to crashes or information leakage. Handling of plain/non-hybrid PQ key operation is not affected. This issue has been patched in in v0.6.1. All users are advised to upgrade. There are no workarounds for this issue.

Affected products

• Open-Quantum-Safe Oqs-Provider: before 0.6.1 (fixed in 0.6.1)
• Open Quantum Safe Oqs Provider: before 0.6.1 (fixed in 0.6.1)

Published 2024-06-17. Last modified 2026-06-17.