libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-kem (0.0.2)

libcrux-kem CARGO version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-kem and may be impacted: - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0330...

RUSTSEC-2026-0330 Hybrid Encapsulation from Seed Panics on Short Seed

For a hybrid KEM public key of type PublicKey::WingKemDraft06 or PublicKey::X25519MlKem768Draft06, the PublicKey::encapsulatederand function would panic in an indexing operation on a seed input of length shorter than 32 bytes. Impact Applications encapsulating with an attacker controlled seed val...

Hybrid Encapsulation from Seed Panics on Short Seed

For a hybrid KEM public key of type PublicKey::WingKemDraft06 or PublicKey::X25519MlKem768Draft06, the PublicKey::encapsulatederand function would panic in an indexing operation on a seed input of length shorter than 32 bytes. Impact Applications encapsulating with an attacker controlled seed val...

PT-2026-108122

For a hybrid KEM public key of type PublicKey::WingKemDraft06 or PublicKey::X25519MlKem768Draft06, the PublicKey::encapsulate derand function would panic in an indexing operation on a seed input of length shorter than 32 bytes. Impact Applications encapsulating with an attacker controlled seed...

RUSTSEC-2026-0331 Panic on Decoding Short Hybrid Keys

The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...

libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-kem (0.0.2)

libcrux-kem CARGO version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-kem and may be impacted: - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0331...

Panic on Decoding Short Hybrid Keys

The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...

PT-2026-107471

The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...

libcrux-digest (>=0.0.4-pre.1, <=0.0.9-pre.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +11 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.10-pre.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =1.20.4, =0.2.0, =0.4.3, =0.8.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0208...

libcrux-digest (>=0.0.4-pre.1, <=0.0.9-pre.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +11 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.10-pre.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =1.20.4, =0.2.0, =0.4.3, =0.8.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0207...

libcrux-digest (>=0.0.4-pre.1, <=0.0.7-rc.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.8-rc.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: GHSA-Q29P-9PFR-J652...

libcrux-digest (>=0.0.4-pre.1, <=0.0.7-rc.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.8-rc.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-Q29P-9PFR-J652...

libcrux-digest (>=0.0.4-pre.1, <=0.0.7-rc.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.8-rc.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0074...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (>=0.0.2-beta.3, <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:GHSA-435G-FCV3-8J26...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-ecdh (>=0.0.2-beta.3, <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: GHSA-435G-FCV3-8J26...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (>=0.0.2-beta.3, <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:RUSTSEC-2026-0023...