RUSTSEC-2026-0208 Potential Panic in AVX2 SHAKE-256
A panic in the AVX2 SHAKE-256 implementation allows denial of service when using specific output buffer lengths outside standard ML-KEM/ML-DSA usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0208?
RUSTSEC-2026-0208 is a denial of service vulnerability in libcrux-sha3, published on 21 May 2026.
Official description
The AVX2-optimized implementation of SHAKE-256 intended for use in ML-KEM and ML-DSA would panic if the length of the output buffers was greater than 32 and not a multiple of 8, due to an out-of-bounds indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Which versions are affected by RUSTSEC-2026-0208?
1 open source package ship an affected version, including libcrux-sha3.
| Package | Affected | Fixed in |
|---|---|---|
libcrux-sha3 crates.io | From 0.0.0-0 | 0.0.10 |
How do I fix RUSTSEC-2026-0208?
Upgrade libcrux-sha3 to 0.0.10 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is RUSTSEC-2026-0208 being exploited?
There is no known exploitation of RUSTSEC-2026-0208 in the wild and no public exploit code.