{"id":"RUSTSEC-2026-0330","aliases":[],"status":"published","title":"Hybrid Encapsulation from Seed Panics on Short Seed","description":"For a hybrid KEM public key of type `PublicKey::WingKemDraft06` or `PublicKey::X25519MlKem768Draft06`, the `PublicKey::encapsulate_derand` function would panic in an indexing operation on a seed input of length shorter than 32 bytes.\n\n# Impact\n\nApplications encapsulating with an attacker controlled seed value could be made to panic. Since the encapsulation seed should be considered a secret of the encapsulating party for the KEM to remain secure, an application should never take the seed value from a potentially attacker controlled source.\n\n# Mitigation\n\nWith release of version `0.0.10` of `libcrux-kem` this bug has been fixed and the serialization functions return `InvalidPrivateKey` and `InvalidPublicKey` errors on invalid input buffer lengths.\n\nWe recommend users upgrade to `libcrux-kem` version `0.0.10`.","severity":{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-28T12:00:00Z","modified":"2026-10-07T08:30:02Z","fixes":[{"ecosystem":"crates.io","package":"libcrux-kem","fixed_in":["0.0.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"libcrux-kem","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.0.10"}]}]}],"references":[{"url":"https://crates.io/crates/libcrux-kem","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0330.html","tags":["advisory"]},{"url":"https://github.com/celabshq/libcrux/pull/1595","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0330","title":"Hybrid Encapsulation from Seed Panics on Short Seed","description":"For a hybrid KEM public key of type `PublicKey::WingKemDraft06` or `PublicKey::X25519MlKem768Draft06`, the `PublicKey::encapsulate_derand` function would panic in an indexing operation on a seed input of length shorter than 32 bytes.\n\n# Impact\n\nApplications encapsulating with an attacker controlled seed value could be made to panic. Since the encapsulation seed should be considered a secret of the encapsulating party for the KEM to remain secure, an application should never take the seed value from a potentially attacker controlled source.\n\n# Mitigation\n\nWith release of version `0.0.10` of `libcrux-kem` this bug has been fixed and the serialization functions return `InvalidPrivateKey` and `InvalidPublicKey` errors on invalid input buffer lengths.\n\nWe recommend users upgrade to `libcrux-kem` version `0.0.10`.","status":"published","published":"2026-09-28T12:00:00Z","modified":"2026-10-07T08:30:02.862241231Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}