CVE-2026-76234

Name of the Vulnerable Software and Affected Versions libcrux-ecdh versions prior to 0.0.6 libcrux-ed25519 versions prior to 0.0.6 libcrux-psq versions prior to 0.0.7

Description Cryptographic implementation bugs exist across multiple components. In libcrux-ecdh, length and clamping were not properly checked during X25519 secret validation, and the clamping check for imported X25519 secret keys was broken. In libcrux-ed25519, a duplicated clamping step occurred during key generation. Additionally, libcrux-psq experienced a panic instead of propagating an AEADError, which is an error related to Authenticated Encryption with Associated Data (AEAD).

Recommendations Update libcrux-ecdh to version 0.0.6 or later. Update libcrux-ed25519 to version 0.0.6 or later. Update libcrux-psq to version 0.0.7 or later.