CVE-2026-76234

libcrux-ecdh (before 0.0.6) had broken X25519 length/clamping validation; libcrux-ed25519 (before 0.0.6) duplicated clamping during key generation; libcrux-psq (before 0.0.7) panicked instead of propagating AEADError. CVSS 3.1 scores availability impact HIGH (7.5) and CVSS 4.0 scores 8.7. No expl...

EUVD-2026-62475

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

RUSTSEC-2026-0023 X25519 secret validation did not check buffer length or clamping

The latest releases of the libcrux-ecdh crate contains the following bug-fix: 1301: Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length...