libcrux before 0.0.6 Cryptographic Implementation Bug Fixes (CVE-2026-76234)

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps libcrux-ecdh (crates.io), libcrux-ecdh (crates.io), libcrux-ed25519 (crates.io), libcrux-ed25519 (crates.io) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
libcrux-ecdhcrates.io	>=0 <0.0.6	0.0.6
libcrux-ecdhcrates.io	>=0.0.0-0 <0.0.6	0.0.6
libcrux-ed25519crates.io	>=0 <0.0.6	0.0.6
libcrux-ed25519crates.io	>=0.0.0-0 <0.0.6	0.0.6
libcrux-psqcrates.io	>=0 <0.0.7	0.0.7
libcrux-psqcrates.io	>=0.0.0-0 <0.0.7	0.0.7
celabshq/libcruxgeneric	>=0 <0.0.6	0.0.6
celabshq/libcruxgeneric	>=0 <0.0.7	0.0.7
celabshq/libcrux-ecdhgeneric	>=0 <0.0.6	0.0.6
celabshq/libcrux-ed25519generic	>=0 <0.0.6	0.0.6
celabshq/libcrux-psqgeneric	>=0 <0.0.7	0.0.7

Recommended response

Check inventory. Check lockfiles and deployed manifests for libcrux-ecdh, libcrux-ecdh, libcrux-ed25519.
Review the reported fix. Update libcrux-ecdh to 0.0.6; libcrux-ecdh to 0.0.6; libcrux-ed25519 to 0.0.6; libcrux-ed25519 to 0.0.6; libcrux-psq to 0.0.7; libcrux-psq to 0.0.7; celabshq/libcrux to 0.0.6; celabshq/libcrux to 0.0.7; celabshq/libcrux-ecdh to 0.0.6; celabshq/libcrux-ed25519 to 0.0.6; celabshq/libcrux-psq to 0.0.7 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 19, 2026

Sources and claim methodology

Upstream source description

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.

Quoted source text, attributed separately from HOL analysis.