PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash
Date: 2025-03
Affected: pip/PostQuantum-Feldman-VSS
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CWE: CWE-400

**Description:** PostQuantum-Feldman-VSS, a Python library implementing Feldman's Verifiable Secret Sharing scheme with post-quantum security, was vulnerable to denial-of-service attacks in versions up to and including 0.7.6b0. This vulnerability stems from the library's reliance on the `gmpy2` library for arbitrary-precision arithmetic. `gmpy2`, in turn, depends on the GNU Multiple Precision Arithmetic Library (GMP). GMP, by design, terminates the process when it cannot allocate memory. An attacker could exploit this by providing carefully crafted inputs that cause `gmpy2` to attempt to allocate extremely large amounts of memory, leading to a crash of the Python interpreter and thus a denial of service. **Vulnerability Details:** The core issue lies in the behavior of GMP (and thus, `gmpy2`) when memory allocation fails. Instead of raising a standard Python exception that could be caught and handled, GMP terminates the entire process. This behavior is documented in the GMP and gmpy2 documentation: * **GMP Memory Management:** [https://gmplib.org/manual/Memory-Management](https://gmplib.org/manual/Memory-Management) (States that the default behavior is to terminate the program.) * **gmpy2 Overview:** [https://gmpy2.readthedocs.io/en/latest/overview.html](https://gmpy2.readthedocs.io/en/latest/overview.html) (Warns that `gmpy2` can crash the interpreter on memory allocation failure.) Specific operations within the PostQuantum-Feldman-VSS library that were particul


Mitigations:

Architectural layers (MAESTRO):