Security update for liboqs
This update for liboqs fixes the following issues: Changes in liboqs: Updated to 0.16.0: Deprecation notice: - SPHINCS+ was removed in 0.16.0. Security issues: - Fixed uninitialized `encaps_derand` pointer dereference - CVE-2026-46344, CVE-2026-44518: Fixed out-of-bounds read in XMSS/XMSS^MT signature verification (bsc#1267007 bsc#1267001) - Fixed Integer underflow in CROSS `crypto_sign_open()` - Fixed incorrect array size when calling `secure_clean` - Implemented optimization barrier `OQS_MEM_BLACK_BOX` and applied to `ct_select` in FrodoKEM Significant change: FrodoKEM algorithm change: * Existing FrodoKEM in 0.15.0 was renamed to ephemeral FrodoKEM (`KEM_efrodokem_<640|976|1344>_`), and the salted variant of FrodoKEM was added under the prior names (`KEM_frodokem_<640|976|1344>_`). Ephemeral FrodoKEM is recommended for applications where each keypair will encapsulate only a small number of shared secrets and ciphertexts. Standard (salted) FrodoKEM is recommended for applications where each keypair is expected to encapsulate large number of ciphertexts. Please consult [upstream](https://github.com/microsoft/PQCrypto-LWEKE/#frodokem-learning-with-errors-key-encapsulation) for more details. * mldsa-native integration: mldsa-native is a secure, fast, and portable C90 implementation of the ML-DSA post-quantum signature standard. It also includes optimized builds for x86_64 and aarch64. It is now the default implementation behind `SIG_ml_dsa_<44|65|87>`. * Updated HQC implementa
SUSE-SU-2026:23313-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23313-1
liboqs
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.16.0-160000.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
oqs-provider
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.11.0.32-160000.1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
liboqs
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.16.0-160000.1.1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
oqs-provider
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.11.0.32-160000.1.1
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16.0-160000.1.1"
}
]
}
],
"package": {
"name": "liboqs",
"purl": "pkg:rpm/suse/liboqs&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23313-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"liboqs9": "0.16.0-160000.1.1",
"liboqs-devel": "0.16.0-160000.1.1",
"oqs-provider": "0.11.0.32-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0.32-160000.1.1"
}
]
}
],
"package": {
"name": "oqs-provider",
"purl": "pkg:rpm/suse/oqs-provider&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23313-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"liboqs9": "0.16.0-160000.1.1",
"liboqs-devel": "0.16.0-160000.1.1",
"oqs-provider": "0.11.0.32-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16.0-160000.1.1"
}
]
}
],
"package": {
"name": "liboqs",
"purl": "pkg:rpm/suse/liboqs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23313-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"liboqs9": "0.16.0-160000.1.1",
"liboqs-devel": "0.16.0-160000.1.1",
"oqs-provider": "0.11.0.32-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0.32-160000.1.1"
}
]
}
],
"package": {
"name": "oqs-provider",
"purl": "pkg:rpm/suse/oqs-provider&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23313-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"liboqs9": "0.16.0-160000.1.1",
"liboqs-devel": "0.16.0-160000.1.1",
"oqs-provider": "0.11.0.32-160000.1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #17555 · Revision 1
- Added to Heist Feed
- Publisher date