Libcrux
Monthly
Multiple cryptographic implementation defects in the libcrux Rust crates - libcrux-ecdh, libcrux-ed25519, and libcrux-psq - expose applications to availability failures and potential key-material weaknesses. libcrux-ecdh omitted length validation and clamping enforcement on X25519 secret inputs (including a broken clamping check for imported keys), libcrux-ed25519 applied a duplicated clamping step during key generation that could silently corrupt key material, and libcrux-psq panicked on AEAD decryption errors instead of returning them to callers. Vendor-released patch versions 0.0.6 (ecdh, ed25519) and 0.0.7 (psq) resolve all three defects; no public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple cryptographic implementation defects in the libcrux Rust crates - libcrux-ecdh, libcrux-ed25519, and libcrux-psq - expose applications to availability failures and potential key-material weaknesses. libcrux-ecdh omitted length validation and clamping enforcement on X25519 secret inputs (including a broken clamping check for imported keys), libcrux-ed25519 applied a duplicated clamping step during key generation that could silently corrupt key material, and libcrux-psq panicked on AEAD decryption errors instead of returning them to callers. Vendor-released patch versions 0.0.6 (ecdh, ed25519) and 0.0.7 (psq) resolve all three defects; no public exploit code or CISA KEV listing has been identified at time of analysis.