CVE-2026-76234

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234

libcrux-ecdh (before 0.0.6) had broken X25519 length/clamping validation; libcrux-ed25519 (before 0.0.6) duplicated clamping during key generation; libcrux-psq (before 0.0.7) panicked instead of propagating AEADError. CVSS 3.1 scores availability impact HIGH (7.5) and CVSS 4.0 scores 8.7. No expl...

EUVD-2026-62475

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

PT-2026-78416

Name of the Vulnerable Software and Affected Versions libcrux-ecdh versions prior to 0.0.6 libcrux-ed25519 versions prior to 0.0.6 libcrux-psq versions prior to 0.0.7 Description Cryptographic implementation bugs exist across multiple components. In libcrux-ecdh, length and clamping were not...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (0.0.2-beta.3)

libcrux-ecdh CARGO version 0.0.2-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ecdh and may be impacted: - libcrux-kem =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:GHSA-435G-FCV3-8J...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (0.0.2-beta.3)

libcrux-ecdh CARGO version 0.0.2-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ecdh and may be impacted: - libcrux-kem =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:RUSTSEC-2026-0023...

RUSTSEC-2026-0023 X25519 secret validation did not check buffer length or clamping

The latest releases of the libcrux-ecdh crate contains the following bug-fix: 1301: Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length...