libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-kem (0.0.2)

libcrux-kem CARGO version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-kem and may be impacted: - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0330...

libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-kem (0.0.2)

libcrux-kem CARGO version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-kem and may be impacted: - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0331...

CVE-2026-76234

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234

libcrux-ecdh (before 0.0.6) had broken X25519 length/clamping validation; libcrux-ed25519 (before 0.0.6) duplicated clamping during key generation; libcrux-psq (before 0.0.7) panicked instead of propagating AEADError. CVSS 3.1 scores availability impact HIGH (7.5) and CVSS 4.0 scores 8.7. No expl...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

EUVD-2026-62475

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

CVE-2026-76234: Improper Verification of Cryptographic Signature

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation and had a broken clamping check for imported X25519 secret keys; libcrux-ed25519 performe...

libcrux-digest (>=0.0.4-pre.1, <=0.0.9-pre.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +11 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.10-pre.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =1.20.4, =0.2.0, =0.4.3, =0.8.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0208...

libcrux-digest (>=0.0.4-pre.1, <=0.0.7-rc.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.8-rc.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: GHSA-Q29P-9PFR-J652...

libcrux-digest (>=0.0.4-pre.1, <=0.0.7-rc.1), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2-beta.3, <=0.0.8-rc.1)

libcrux-sha3 CARGO version =0.0.2-beta.3, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0074...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-ecdh (>=0.0.2-beta.3, <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: GHSA-435G-FCV3-8J26...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (>=0.0.2-beta.3, <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:GHSA-435G-FCV3-8J26...

PT-2026-21481

In accordance with our security policy for libcrux, we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the libcrux-ecdh, libcrux-ed25519 and libcrux-psq crates contain the following bug-fixes:...

Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

The latest releases of the libcrux-psq crate contains the following bug-fix: 1319: Propagate AEADError instead of panicking The issue fixed in 1319 was first reported by Nadim Kobeissi...

RUSTSEC-2026-0025 Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

The latest releases of the libcrux-psq crate contains the following bug-fix: 1319: Propagate AEADError instead of panicking The issue fixed in 1319 was first reported by Nadim Kobeissi...

Incorrect X25519 clamping check rejects all secrets on import

The latest releases of the libcrux-psq crate contains the following bug-fix: 1301: Fix broken clamping check for imported X25519 secret keys...

RUSTSEC-2026-0024 Incorrect X25519 clamping check rejects all secrets on import

The latest releases of the libcrux-psq crate contains the following bug-fix: 1301: Fix broken clamping check for imported X25519 secret keys...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (>=0.0.2-beta.3, <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:RUSTSEC-2026-0023...