{"id":"CVE-2026-76234","aliases":["GHSA-435g-fcv3-8j26","RUSTSEC-2026-0023","RUSTSEC-2026-0024","RUSTSEC-2026-0025","RUSTSEC-2026-0026"],"url":"https://o3.security/vulnerability/CVE-2026-76234","summary":"libcrux before 0.0.6 Cryptographic Implementation Bug Fixes","details":"In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:\n\n## `libcrux-ecdh`\n\n- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length\n\n## `libcrux-ed25519`\n\n- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation\n\nThe issue fixed in #1320 was first reported by Nadim Kobeissi.\n## `libcrux-psq`\n\n- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking\n- [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys\n\nThe issue fixed in #1319 was first reported by Nadim Kobeissi.","published":"2026-08-19T14:02:14.481Z","modified":"2026-10-29T02:30:44.337145529Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"libcrux-ecdh","fixedVersion":"0.0.6"},{"ecosystem":"crates.io","name":"libcrux-ed25519","fixedVersion":"0.0.6"},{"ecosystem":"crates.io","name":"libcrux-psq","fixedVersion":"0.0.7"}],"fix":{"url":"https://github.com/cryspen/libcrux/pull/1301","label":"cryspen/libcrux#1301"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76234.json"},{"type":"ADVISORY","url":"https://github.com/celabshq/libcrux/security/advisories/GHSA-435g-fcv3-8j26"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76234"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libcrux-before-cryptographic-implementation-bug-fixes"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/security/advisories/GHSA-435g-fcv3-8j26"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/pull/1301"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/pull/1319"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/pull/1320"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/commit/4d6f5d3c2542b6179a6474dec8cfb8b8ddf31a84"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/commit/a09022c5811ca7fd1c6d9a239ff294d64ee86734"},{"type":"WEB","url":"https://github.com/cryspen/libcrux/commit/f303b6446c19fe9a7c993f61e426023609cd5fac"},{"type":"PACKAGE","url":"https://github.com/cryspen/libcrux"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0023.html"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0024.html"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0025.html"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0026.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T02:30:44.337145529Z"}}