CVE-2024-54137

Name of the Vulnerable Software and Affected Versions: liboqs versions prior to 0.12.0

Description: A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism in liboqs, a C-language cryptographic library. The error is due to an indexing issue, causing part of the secret key to be incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext.

Recommendations: For versions prior to 0.12.0, update to version 0.12.0 to resolve the issue.