Quantum-Algorithm-for-Elliptic-Curve-Discrete-Logarithms-with-Space-Efficient-Point-Addition

Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition This repository contains Qiskit code for resource estimation of the space-efficient quantum modular inversion and affine point-addition circuits used in elliptic-curve discrete logarithm settings. The...

CVE-2026-19795

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

CVE-2026-19795 Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

CVE-2026-19795

IBM Qiskit SDK versions 2.1.0 through 2.5.1 are vulnerable to a denial of service when deserializing QPY files . The root cause is improper handling of a specially crafted object during deserialization, which may overflow the available stack space and trigger a segmentation fault , crashing the a...

CVE-2026-19795 Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

EUVD-2026-70714

IBM Qiskit SDK 2.1.0 through 2.5.1 could allow a local attacker to cause a denial of service due to improper handling of a specially crafted object during deserialization. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

amplify-quantum (>=1.1.1, <=1.3.1), aqmlator (>=0.1.1, <=0.1.2) +106 more potentially affected by CVE-2026-19795 via qiskit (>=2.1.0, <=2.5.0)

qiskit PYPI version =2.1.0, =1.1.1, =0.1.1, =0.3.3, =3.2.0, =0.4.2, =0.1.1, =1.0.5, =26.1.2, =2.59.0, =0.2.0, =0.3.0 and more Source cves: CVE-2026-19795 Source advisory: MEND:CVE-2026-19795...

Security Bulletin: Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Summary A maliciously constructed QPY payload that contains specifically constructed ParameterExpression objects as part of the payload can trigger a segfault in the evaluation of those expressions during deserialization. The function qiskit.qpy.load may recurse too deeply and overflow the...

PT-2026-85243

IBM Qiskit SDK 2.1.0 through 2.5.1 could allow a local attacker to cause a denial of service due to improper handling of a specially crafted object during deserialization. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

CVE-2026-19795: Deserialization of Untrusted Data

Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input...

cvxpy (>=1.1.22, <=1.3.0), cvxpy-base (>=1.1.22, <=1.3.0) +3 more potentially affected by CVE-2026-59890 via setuptools (64.0.2)

setuptools PYPI version 64.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvxpy =1.1.22, =1.1.22, =0.0.0, =0.2.0, =0.2.3 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

autoqasm (0.1.1), mpqp (>=0.2.0, <=0.5.0) +3 more potentially affected by CVE-2026-9291 via amazon-braket-sdk (>=1.11.1, <=1.107.0)

amazon-braket-sdk PYPI version =1.11.1, =0.2.0, =0.14.0, =0.0.11.dev1, =0.1.0, =0.1.3 Source cves: CVE-2026-9291 Source advisory: OSV:PYSEC-2026-2342...

aqmlator (0.2.0), ariadne-router (0.4.3) +76 more potentially affected by CVE-2025-1403 via qiskit (>=0.45.0, <=1.2.4)

qiskit PYPI version =0.45.0, =0.0.1, =0.0.0, =2.0.0, =0.0.3, =0.1.1, =1.3.0, =0.2.0, =0.1.1, =0.1.0, =0.1.3 - mqt-predictor 2.0.0 - mqt-problemsolver 0.1.0 and more Source cves: CVE-2025-1403 Source advisory: OSV:PYSEC-2026-3045...

cvxpy (>=1.1.22, <=1.3.0), cvxpy-base (>=1.1.22, <=1.3.0) +3 more potentially affected by CVE-2026-59890 via setuptools (64.0.2)

setuptools PYPI version 64.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvxpy =1.1.22, =1.1.22, =0.0.0, =0.2.0, =0.2.3 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

aqmlator (>=0.1.1, <=0.1.2), bandcalq (0.0.1) +111 more potentially affected by CVE-2025-1403 via qiskit-terra (>=0.45.0, <=0.46.3)

qiskit-terra PYPI version =0.45.0, =0.1.1, =2.0.0, =0.0.3, =0.0.0, =0.9.1, =0.5.0, =0.0.0, =0.1.1, =1.0.4, =0.1.0, =0.1.1, =1.3.0, =0.2.0, =0.2.2 and more Source cves: CVE-2025-1403 Source advisory: OSV:PYSEC-2026-1859...

PYSEC-2026-1859 Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...

cvxpy (>=1.1.22, <=1.3.0), cvxpy-base (>=1.1.22, <=1.3.0) +3 more potentially affected by CVE-2024-6345 via setuptools (64.0.2)

setuptools PYPI version 64.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvxpy =1.1.22, =1.1.22, =0.0.0, =0.2.0, =0.2.3 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

PYSEC-2026-1858 `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Summary deserializing json data using qiskitibmruntime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string Details RuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one...

`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Summarydeserializing json data using qiskitibmruntime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string DetailsRuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one ca...

bosonic-qiskit (>=0.0.0, <=12.2.6), generic-qaoa (>=0.1.0, <=0.1.3) +14 more potentially affected by CVE-2024-29032 via qiskit-ibm-runtime (>=0.6.2, <=0.20.0)

qiskit-ibm-runtime PYPI version =0.6.2, =0.0.0, =0.1.0, =1.3.0, =0.2.0, =0.2.2, =0.34.1, =0.1.0, =0.6.0, =0.32.0, =0.3.0, =0.1.2, =0.0.12.dev5, =0.0.0, =17.0.0 and more Source cves: CVE-2024-29032 Source advisory: OSV:PYSEC-2026-1858...