monero-project/monero

Scanned on Jun 5, 2026

Risk score/ 100

High risk

Summary

Monero's codebase contains critical quantum-vulnerable cryptographic implementations including MD5 for HTTP authentication, RSA key generation without quantum resistance, and ECDSA cipher suites. While the core Monero protocol uses quantum-resistant primitives, the networking and authentication layers expose significant post-quantum vulnerabilities that could compromise secure communications and authentication mechanisms.

Critical

High

Medium

Low

Top findings

CriticalMD5
contrib/epee/src/http_auth.cpp:110
SHA3-256 or SHA-256
Raw evidence
```
static constexpr const boost::string_ref name = ceref(u8"MD5");
```
CriticalMD5
contrib/epee/src/http_auth.cpp:144
SHA3-256 or SHA-256
Raw evidence
```
EVP_DigestInit(ctx.get(), EVP_md5());
```
CriticalSSLv2 / SSLv3
contrib/epee/src/net_ssl.cpp:210
Raw evidence
```
ssl_context.set_options(boost::asio::ssl::context::no_sslv2);
```
CriticalSSLv2 / SSLv3
contrib/epee/src/net_ssl.cpp:211
Raw evidence
```
ssl_context.set_options(boost::asio::ssl::context::no_sslv3);
```
CriticalTLS 1.0 / 1.1
contrib/epee/src/net_ssl.cpp:212
Raw evidence
```
ssl_context.set_options(boost::asio::ssl::context::no_tlsv1);
```

+ 4 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan