GitHub Advisoryadvisory · crates.io

GHSA-435g-fcv3-8j26 Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

LOW Published 2026-02-12 Modified 2026-02-27 Official page ↗
Ecosystem
crates.io
Packages
libcrux-ecdh, libcrux-ed25519, libcrux-psq
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-327
Reviewed
2026-02-12

Affected packages

• crates.io libcrux-ecdh: < 0.0.6 → fixed in 0.0.6 • crates.io libcrux-ed25519: < 0.0.6 → fixed in 0.0.6 • crates.io libcrux-psq: < 0.0.7 → fixed in 0.0.7

Description

In accordance with our security policy for `libcrux`, we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes: `libcrux-ecdh` • #1301: Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length `libcrux-ed25519` • #1320: Remove duplicated clamping step during key generation The issue fixed in #1320 was first reported by Nadim Kobeissi. `libcrux-psq` • #1319: Propagate AEADError instead of panicking • #1301: Fix broken clamping check for imported X25519 secret keys The issue fixed in #1319 was first reported by Nadim Kobeissi.

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References