Cryptographic Implementation Bugs in libcrux by Celabs

CVE-2026-76234

What is CVE-2026-76234?

Versions of libcrux prior to 0.0.6 for libcrux-ecdh and libcrux-ed25519, as well as libcrux-psq before 0.0.7, expose critical cryptographic implementation issues. The libcrux-ecdh library fails to adequately validate the length and clamping of X25519 secret keys, presenting a risk for incorrect secret key validation. Meanwhile, libcrux-ed25519 incorrectly implements a redundant clamping step during key generation, which can lead to weaknesses in generated keys. Additionally, libcrux-psq is flawed in its error handling, resulting in a panic instead of appropriately propagating an AEADError. These vulnerabilities highlight the necessity for timely patching, which has been addressed in recent releases.

References