CVE-2026-44519

Name of the Vulnerable Software and Affected Versions liboqs versions prior to 0.16.0

Description The ct select() function in src/kem/frodokem/external/util.c for FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barrier in the Fujisaki-Okamoto implicit-rejection path. When compiled with Clang 17 or later using specific optimization levels like -Os, the compiler may generate a secret-dependent conditional load. This results in distinguishable cache residency between successful and failed decapsulation paths. A local attacker could perform repeated cache-timing measurements to use this oracle for a private-key recovery attack.

Recommendations Update to version 0.16.0.