CVE-2026-76234 in libcrux
Summary
by MITRE • 08/19/2026
libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The cryptographic libraries within the libcrux ecosystem, specifically versions prior to 0.0.6 for ECDH and Ed25519 implementations, and prior to 0.0.7 for PSQ, contained critical implementation flaws that compromised the integrity of key handling and error propagation mechanisms. These vulnerabilities stem from deviations in strict adherence to cryptographic standards during secret validation, key generation, and authenticated encryption operations. The issues affect core components responsible for elliptic curve Diffie-Hellman key exchange, digital signatures using Ed25519, and post-quantum secure communication protocols based on the PSQ construction.
In the libcrux-ecdh module, the X25519 secret validation process suffered from insufficient length checks and flawed clamping logic. The X25519 algorithm requires that scalar values be properly masked to ensure they lie within a specific subgroup order, preventing small-subgroup attacks and ensuring constant-time execution properties are maintained. The vulnerability involved a failure to correctly validate the byte length of incoming secrets before processing them. Furthermore, the clamping operation, which is essential for masking bits in the secret key to prevent side-channel leakage and enforce mathematical constraints on the curve, was implemented incorrectly when handling imported X25519 secret keys. This broken clamping check means that invalid or maliciously crafted inputs could potentially bypass security checks, leading to undefined behavior or potential information disclosure through timing variations if constant-time guarantees were assumed but not enforced due to early exits on malformed input lengths.
The libcrux-ed25519 implementation exhibited a logical error during the key generation phase characterized by duplicated clamping steps. While redundant operations do not always constitute a vulnerability, in cryptographic contexts, incorrect application of masking can alter the resulting private key material if the duplication interacts unexpectedly with subsequent arithmetic or memory states. More critically, such deviations from the standard Ed25519 specification may lead to non-deterministic behavior across different platforms or compiler optimizations, potentially causing interoperability failures where signatures generated by this library are rejected by compliant implementations. This lack of deterministic correctness undermines trust in digital signature verification processes and can disrupt secure communication channels that rely on consistent key material generation.
Additionally, the libcrux-psq component demonstrated poor error handling practices by panicking instead of propagating an AEADError when encountering issues during authenticated encryption with associated data operations. In Rust-based cryptographic libraries, panics result in immediate termination of the thread or process rather than graceful error recovery. This behavior violates best practices for secure software engineering where errors should be returned to the caller for appropriate handling. The abrupt termination can lead to denial-of-service conditions if triggered by malformed ciphertexts or invalid inputs from untrusted sources. It also obscures the root cause of failures during debugging and prevents applications from implementing proper fallback mechanisms or logging strategies, thereby reducing overall system resilience against targeted attacks aimed at inducing crashes.
These vulnerabilities align with CWE-20 Improper Input Validation regarding the length checks in ECDH, CWE-754 Incorrect Check for Unusual or Exceptional Conditions related to the error handling in PSQ, and CWE-693 Protection Mechanism Failure concerning the broken clamping logic that fails to enforce security constraints. From an ATT&CK perspective, these flaws could be exploited by adversaries performing Denial of Service via application crashes (T1499) or potentially leveraging side-channel attacks if timing variations are introduced through improper validation paths in ECDH operations. The lack of robust error propagation also hinders incident response efforts as crash dumps may not provide sufficient context for forensic analysis compared to structured error codes.
Mitigation strategies require immediate upgrading to patched versions where libcrux-ecdh and libcrux-ed25519 are updated to version 0.0.6 or later, and libcrux-psq is updated to version 0.0.7 or later. These releases address the clamping logic errors, enforce strict length validation for imported keys, correct the key generation duplication issue, and replace panic calls with proper error propagation mechanisms. Organizations relying on these libraries should verify their dependency trees and ensure that all instances of libcrux components are updated to mitigate risks associated with cryptographic implementation flaws. Regular security audits focusing on input validation and error handling in cryptographic modules are recommended to prevent similar issues in future implementations.