vulnerability
FreeBSD: VID-aeac223e-60e1-11f0-8baa-8447094a420f (CVE-2025-52473): liboqs -- Secret-dependent branching in HQC
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:C/I:N/A:N) | Jul 14, 2025 | Jul 15, 2025 | Jun 15, 2026 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:C/I:N/A:N)
Published
Jul 14, 2025
Added
Jul 15, 2025
Modified
Jun 15, 2026
Description
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have been identified in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 (-O1, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key. This vulnerability is fixed in 0.14.0.
Solution
freebsd-upgrade-package-liboqs
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.