The Decompose routine in the RustCrypto Signatures library has a timing side‑channel that is triggered during ML‑DSA signing operations. The side‑channel can give a malicious observer access to internal state used to create signature hints, thereby jeopardising the secrecy of the signing key and the authenticity of signatures. The weakness is classified as CWE‑1240 and does not directly cause crash or denial of service but can compromise confidentiality and integrity of the cryptographic process.

All projects that depend on RustCrypto:signatures instead of version 0.1.0‑rc.2 or earlier are affected. This includes any Rust applications or libraries that import the signatures crate and perform ML‑DSA signing. The patch is available in the 0.1.0‑rc.2 release of the crate.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score is below 1 %, suggesting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to monitor the timing of signing operations with sufficient resolution to extract the leaked data, which typically requires proximity or device‑side‑channel access. With the published fix in 0.1.0‑rc.2, the risk can be mitigated by updating the dependency.