Cryptographic Implementation Vulnerabilities in libcrux

The libcrux cryptographic library, specifically components libcrux-ecdh, libcrux-ed25519, and libcrux-psq, contains implementation bugs that affect cryptographic integrity and system stability. Research indicates that libcrux-ecdh failed to properly validate secret key length and clamping for X25519 keys, leading to potential validation errors. libcrux-ed25519 was found to perform redundant clamping during key generation, while libcrux-psq triggered a panic condition instead of propagating an AEADError when encountering errors. These vulnerabilities are tracked under CVE-2026-76234 and are fixed in libcrux-ecdh version 0.0.6, libcrux-ed25519 version 0.0.6, and libcrux-psq version 0.0.7. The primary impact is the potential for service disruption through forced application panics and non-standard cryptographic behavior that could be triggered by malicious input.

Impact

Successful exploitation or triggering of these vulnerabilities can lead to service denial via application crashes (panics). Furthermore, the improper validation of cryptographic parameters may compromise the intended security properties of X25519 key exchanges or Ed25519 operations in applications that rely on these library versions.

Recommendation

Prioritized actions for development and security engineering teams:

• Inventory all internal applications and services utilizing the libcrux Rust crate.
• Upgrade libcrux-ecdh and libcrux-ed25519 to version 0.0.6 or higher.
• Upgrade libcrux-psq to version 0.0.7 or higher.
• Monitor for application crashes or panic-related logs in services consuming these specific cryptographic primitives, particularly those exposed to unauthenticated network input.