libcrux CVE-2026-76234

For the libcrux-psq panic (denial of service): the target application must use the libcrux-psq crate for AEAD-protected session key exchange, and the attacker must be able to deliver a malformed or unauthenticated ciphertext to the decryption path - no authentication or session establishment required, making this exploitable by any network-reachable party against exposed services. For the libcrux-ecdh clamping defect: exploitation requires either importing an externally-supplied X25519 key (e.g., from a peer in a key exchange protocol) or relying on the library's key validation to reject invalid inputs - previously the library silently accepted non-canonical keys. For the libcrux-ed25519 key-generation bug: exploitation requires that key pairs were generated with the affected library version; the resulting keys may have non-standard properties but the practical cryptographic impact depends on the downstream protocol. Limiting factors: only Rust applications explicitly depending on these specific libcrux crates are affected; the broader ecosystem (applications using ring, RustCrypto, or other crypto backends) is not impacted.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is primarily driven by the libcrux-psq panic path, which can be triggered remotely without authentication by supplying a malformed or unauthenticated ciphertext - any network-exposed application using libcrux-psq for session establishment is vulnerable to process-level denial of service. The clamping defects in libcrux-ecdh and libcrux-ed25519 carry a subtler but potentially higher-impact risk: accepting or generating improperly clamped X25519 keys can undermine the security guarantees of key exchange sessions, and a duplicated clamping step during Ed25519 key generation can silently produce non-standard key material. The assigned vector records no confidentiality or integrity impact (VC:N/VI:N), which likely underestimates the key-material integrity risk - this should be verified against vendor clarification. No EPSS data was provided and no KEV listing exists, indicating no confirmed widespread exploitation. No public exploit code has been identified. The net real-world priority is high for any application that directly handles untrusted ciphertexts via libcrux-psq (crash risk is immediate and unauthenticated) and moderate-to-high for applications relying on libcrux-ecdh key import or libcrux-ed25519 key generation for long-lived cryptographic identities (key-material correctness risk is silent and potentially persistent).

A remote attacker sends a crafted or randomly invalid ciphertext to a service using libcrux-psq for post-quantum session establishment. The library attempts AEAD decryption, encounters an authentication failure, and instead of returning an error to the caller, panics - aborting the process and causing a denial of service for all users of that service. No authentication or special session state is required. No public exploit code has been identified at time of analysis.