CVE-2026-76234 libcrux before 0.0.6 Cryptographic Implementation Bug Fixes
libcrux cryptographic libraries contain implementation bugs in ECDH, Ed25519, and PSQ that compromise security guarantees, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76234?
CVE-2026-76234 is a high-severity vulnerability in celabshq libcrux-ecdh, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.
Weakness: CWE-347
Which versions are affected by CVE-2026-76234?
10 open source packages ship an affected version, including libcrux-ecdh, libcrux-ed25519 and libcrux-psq.
| Package | Affected | Fixed in |
|---|---|---|
libcrux-ecdh crates.io | All versions | 0.0.6 |
libcrux-ecdh crates.io | All versions | 0.0.6 |
libcrux-ecdh crates.io | From 0.0.0-0 | 0.0.6 |
libcrux-ed25519 crates.io | All versions | 0.0.6 |
libcrux-ed25519 crates.io | All versions | 0.0.6 |
libcrux-ed25519 crates.io | From 0.0.0-0 | 0.0.6 |
4 more packages
libcrux-psq crates.io | All versions | 0.0.7 |
libcrux-psq crates.io | All versions | 0.0.7 |
libcrux-psq crates.io | From 0.0.0-0 | 0.0.7 |
libcrux-psq crates.io | From 0.0.0-0 | 0.0.7 |
How do I fix CVE-2026-76234?
Upgrade libcrux-ecdh to 0.0.6 or later.
Is CVE-2026-76234 being exploited?
There is no known exploitation of CVE-2026-76234 in the wild and no public exploit code.
Sources
Also known as GHSA-435g-fcv3-8j26, GHSA-xp2x-phr3-m4r9, RUSTSEC-2026-0023, RUSTSEC-2026-0024, RUSTSEC-2026-0025, RUSTSEC-2026-0026.