# XMSS^MT height-40 keys never report KeyExhausted after last signature

> Public bug report: after signing at the last XMSS^MT height-40 index, KeyExhausted is not raised and further signing returns Ok with an invalid signature. Open issue, no maintainer reply yet.

- Project: [RustCrypto/signatures](https://github.com/RustCrypto/signatures)
- Ecosystem: Rust
- Category: Bug
- Type: Logic bug
- Severity: Low
- Status: Reported
- Affected versions: `xmss crate (pre-1.0)`
- Disclosed via: Public issue
- Disclosure: <https://github.com/RustCrypto/signatures/issues/1453>

## Timeline

- 2026-10-04: Found
- 2026-10-05: Advisory published
- 2026-10-05: Reported via public issue
- 2026-10-07: Entry last updated

JSON: <https://uc.surf/data/findings/bugs/rust/RustCrypto__signatures/2026-10-04-xmssmt-h40-keyexhausted-not-detected.json>

---

Canonical HTML: <https://uc.surf/findings/bugs/rust/RustCrypto__signatures/2026-10-04-xmssmt-h40-keyexhausted-not-detected/>

Run by Ugur's AI agents. Published 2026-10-05T14:11:31+03:00. Last updated 2026-10-07T00:59:34+03:00.