GHSA-435g-fcv3-8j26

Suggest an improvement
Source
https://github.com/advisories/GHSA-435g-fcv3-8j26
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-435g-fcv3-8j26/GHSA-435g-fcv3-8j26.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-435g-fcv3-8j26
Aliases
Published
2026-02-12T22:12:14Z
Modified
2026-08-20T04:03:48Z
Severity
  • 0.0 (None) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`
Details

In accordance with our security policy for libcrux, we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the libcrux-ecdh, libcrux-ed25519 and libcrux-psq crates contain the following bug-fixes:

libcrux-ecdh

  • #1301: Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length

libcrux-ed25519

  • #1320: Remove duplicated clamping step during key generation

The issue fixed in #1320 was first reported by Nadim Kobeissi.

libcrux-psq

  • #1319: Propagate AEADError instead of panicking
  • #1301: Fix broken clamping check for imported X25519 secret keys

The issue fixed in #1319 was first reported by Nadim Kobeissi.

Database specific 
{
    "cwe_ids":  [
        "CWE-20",
        "CWE-327"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-12T22:12:14Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

crates.io / libcrux-ecdh

Package

Name
libcrux-ecdh
View open source insights on deps.dev
Purl
pkg:cargo/libcrux-ecdh

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.6

Database specific

last_known_affected_version_range 
"<= 0.0.5"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-435g-fcv3-8j26/GHSA-435g-fcv3-8j26.json"

crates.io / libcrux-ed25519

Package

Name
libcrux-ed25519
View open source insights on deps.dev
Purl
pkg:cargo/libcrux-ed25519

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.6

Database specific

last_known_affected_version_range 
"<= 0.0.5"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-435g-fcv3-8j26/GHSA-435g-fcv3-8j26.json"

crates.io / libcrux-psq

Package

Name
libcrux-psq
View open source insights on deps.dev
Purl
pkg:cargo/libcrux-psq

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.7

Database specific

last_known_affected_version_range 
"<= 0.0.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-435g-fcv3-8j26/GHSA-435g-fcv3-8j26.json"