{"id":"CVE-2026-76234","aliases":["EUVD-2026-62475","GHSA-435g-fcv3-8j26","GHSA-xp2x-phr3-m4r9","RUSTSEC-2026-0023","RUSTSEC-2026-0024","RUSTSEC-2026-0025","RUSTSEC-2026-0026"],"status":"published","title":"libcrux before 0.0.6 Cryptographic Implementation Bug Fixes","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00307,"percentile":0.23817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-327","CWE-347"],"published":"2026-01-26T12:00:00Z","modified":"2026-10-29T02:30:44Z","fixes":[{"ecosystem":"crates.io","package":"libcrux-ecdh","fixed_in":["0.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"crates.io","package":"libcrux-ed25519","fixed_in":["0.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"crates.io","package":"libcrux-psq","fixed_in":["0.0.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"libcrux-ecdh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.5"},{"fixed":"0.0.6"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"libcrux-ed25519","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.5"},{"fixed":"0.0.6"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"libcrux-psq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.6"},{"fixed":"0.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-ecdh","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-ed25519","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-psq","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-ecdh","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.0.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-psq","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-psq","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libcrux-ed25519","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.0.6"}]}]}],"products":[{"vendor":"celabshq","product":"libcrux-ecdh"},{"vendor":"celabshq","product":"libcrux-ed25519"},{"vendor":"celabshq","product":"libcrux-psq"}],"references":[{"url":"https://github.com/celabshq/libcrux/security/advisories/GHSA-435g-fcv3-8j26","tags":["vendor-advisory","advisory"]},{"url":"https://www.vulncheck.com/advisories/libcrux-before-cryptographic-implementation-bug-fixes","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/cryspen/libcrux/security/advisories/GHSA-435g-fcv3-8j26","tags":["web"]},{"url":"https://github.com/cryspen/libcrux/pull/1301","tags":["web"]},{"url":"https://github.com/cryspen/libcrux/pull/1319","tags":["web"]},{"url":"https://github.com/cryspen/libcrux/pull/1320","tags":["web"]},{"url":"https://github.com/cryspen/libcrux/commit/4d6f5d3c2542b6179a6474dec8cfb8b8ddf31a84","tags":["web"]},{"url":"https://github.com/cryspen/libcrux/commit/a09022c5811ca7fd1c6d9a239ff294d64ee86734","tags":["web"]},{"url":"https://github.com/cryspen/libcrux/commit/f303b6446c19fe9a7c993f61e426023609cd5fac","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0023.html","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0024.html","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0025.html","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0026.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-435g-fcv3-8j26"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76234","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xp2x-phr3-m4r9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76234.json","tags":["advisory"]},{"url":"https://github.com/cryspen/libcrux","tags":["package"]},{"url":"https://crates.io/crates/libcrux-ecdh","tags":["package"]},{"url":"https://crates.io/crates/libcrux-psq","tags":["package"]},{"url":"https://crates.io/crates/libcrux-ed25519","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-76234","title":"libcrux before 0.0.6 Cryptographic Implementation Bug Fixes","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","status":"published","published":"2026-08-19T14:02:14.481Z","modified":"2026-08-21T11:21:07.741Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:46:32.755125Z"}],"euvd":[{"id":"EUVD-2026-62475","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","status":"published","published":"2026-08-19T14:02:14Z","modified":"2026-08-21T11:21:07Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:37.96401Z"}],"ghsa":[{"id":"GHSA-435g-fcv3-8j26","title":"Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`","description":"In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:\n\n## `libcrux-ecdh`\n\n- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length\n\n## `libcrux-ed25519`\n\n- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation\n\nThe issue fixed in #1320 was first reported by Nadim Kobeissi.\n## `libcrux-psq`\n\n- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking\n- [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys\n\nThe issue fixed in #1319 was first reported by Nadim Kobeissi.","status":"published","published":"2026-02-12T22:12:14Z","modified":"2026-02-27T20:51:09Z","cvss":[{"version":"4.0","score":0,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","level":"none"}],"cwes":["CWE-20","CWE-327"],"updated_at":"2026-11-02T14:39:28.962954Z"},{"id":"GHSA-xp2x-phr3-m4r9","title":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain...","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","status":"published","published":"2026-08-19T15:32:35Z","modified":"2026-08-19T15:32:36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:10:39.892418Z"}],"nvd":[{"id":"CVE-2026-76234","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","status":"published","published":"2026-08-19T14:17:52.797Z","modified":"2026-10-27T13:10:00.36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-76234","title":"libcrux before 0.0.6 Cryptographic Implementation Bug Fixes","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","status":"published","published":"2026-08-19T14:02:14.481Z","modified":"2026-10-29T02:30:44.337145529Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-435g-fcv3-8j26","title":"Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`","description":"In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:\n\n## `libcrux-ecdh`\n\n- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length\n\n## `libcrux-ed25519`\n\n- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation\n\nThe issue fixed in #1320 was first reported by Nadim Kobeissi.\n## `libcrux-psq`\n\n- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking\n- [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys\n\nThe issue fixed in #1319 was first reported by Nadim Kobeissi.","status":"published","published":"2026-02-12T22:12:14Z","modified":"2026-08-20T04:03:48.330165805Z","cvss":[{"version":"4.0","score":0,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","level":"none"}],"cwes":["CWE-20","CWE-327"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"RUSTSEC-2026-0023","title":"X25519 secret validation did not check buffer length or clamping","description":"The latest releases of the libcrux-ecdh crate contains the following\nbug-fix:\n\n[#1301](https://github.com/cryspen/libcrux/pull/1301): Check length\nand clamping in X25519 secret validation. This is a breaking change\nsince errors are now raised on unclamped X25519 secrets or inputs of\nthe wrong length","status":"published","published":"2026-01-26T12:00:00Z","modified":"2026-08-24T08:08:07Z","cvss":[{"version":"4.0","score":0,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","level":"none"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0024","title":"Incorrect X25519 clamping check rejects all secrets on import","description":"The latest releases of the libcrux-psq crate contains the following\nbug-fix:\n\n[#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken\nclamping check for imported X25519 secret keys","status":"published","published":"2026-01-26T12:00:00Z","modified":"2026-08-24T08:08:07Z","cvss":[{"version":"4.0","score":0,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","level":"none"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0025","title":"Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext","description":"The latest releases of the libcrux-psq crate contains the following\nbug-fix:\n\n[#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate\nAEADError instead of panicking\n\nThe issue fixed in\n[#1319](https://github.com/cryspen/libcrux/pull/1319) was first\nreported by Nadim Kobeissi.","status":"published","published":"2026-02-08T12:00:00Z","modified":"2026-08-24T08:08:07Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0026","title":"Unnecessary clamping of seed reduces seed entropy to 251 bits","description":"The latest releases of the libcrux-ed25519 crate contains the\nfollowing bug-fix:\n\n[#1320](https://github.com/cryspen/libcrux/pull/1320): Remove\nduplicated clamping step during key generation\n\nThe issue fixed in\n[#1320](https://github.com/cryspen/libcrux/pull/1320) was first\nreported by Nadim Kobeissi.","status":"published","published":"2026-02-05T12:00:00Z","modified":"2026-08-24T08:08:07Z","cvss":[{"version":"4.0","score":0,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","level":"none"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}