On Mon, 2 Nov 2026 10:52:20 GMT, Timofei Fedotov <[email protected]> wrote:
> HSSPublicKey reads the level count L from raw and X.509 public-key encodings > without checking its range. HSSSignature only checks that Nspk + 1 equals L > before allocating arrays sized by these values. > > A malformed key and a four-byte signature prefix can therefore request very > large reference arrays or negative array sizes before the signature body is > parsed. Outcomes include memory exhaustion and NegativeArraySizeException. > This requires an application to accept the supplied HSS/LMS key and invoke > signature verification; it does not imply that every TLS or certificate path > uses this algorithm. > > Expected behavior: HSS public keys must have 1 through 8 levels, and > signature allocation sizes must be bounded before allocation. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). This pull request has been closed without being integrated. ------------- PR: https://git.openjdk.org/jdk/pull/33670
