Description
libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| celabshq | libcrux-ecdh | < 0.0.6 | 0.0.6 |
| celabshq | libcrux-ed25519 | < 0.0.6 | 0.0.6 |
| celabshq | libcrux-psq | < 0.0.7 | 0.0.7 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | libcrux-ecdh | < 0.0.6 | 0.0.6 | GHSA-435g-fcv3-8j26 |
| crates.io | libcrux-ecdh | >= 0.0.0-0, < 0.0.6 | 0.0.6 | RUSTSEC-2026-0023 |
| crates.io | libcrux-ed25519 | < 0.0.6 | 0.0.6 | GHSA-435g-fcv3-8j26 |
| crates.io | libcrux-ed25519 | >= 0.0.0-0, < 0.0.6 | 0.0.6 | RUSTSEC-2026-0026 |
| crates.io | libcrux-psq | < 0.0.7 | 0.0.7 | GHSA-435g-fcv3-8j26 |
| crates.io | libcrux-psq | >= 0.0.0-0, < 0.0.7 | 0.0.7 | RUSTSEC-2026-0024 |
References
- GitHub Security Advisory (GHSA-435g-fcv3-8j26) vendor-advisory
- VulnCheck Advisory: libcrux before 0.0.6 Cryptographic Implementation Bug Fixes third-party-advisory