{"id":"EUVD-2026-62475","enisaUuid":"03366b65-f061-376a-a303-69c772a92582","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","datePublished":"Aug 19, 2026, 2:02:14 PM","dateUpdated":"Aug 21, 2026, 11:21:07 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/celabshq/libcrux/security/advisories/GHSA-435g-fcv3-8j26\nhttps://www.vulncheck.com/advisories/libcrux-before-cryptographic-implementation-bug-fixes\n","aliases":"CVE-2026-76234\nGHSA-xp2x-phr3-m4r9\n","assigner":"VulnCheck","epss":0.31,"enisaIdProduct":[{"id":"14939a19-d67a-3905-9599-789b72a99562","product":{"name":"libcrux-psq","vendor":{"name":"celabshq"}},"product_version":"0 \u003c0.0.7"},{"id":"577f2ebf-a381-3a94-b5db-5cf658d5f22c","product":{"name":"libcrux-ecdh","vendor":{"name":"celabshq"}},"product_version":"0 \u003c0.0.6"},{"id":"8d7faf63-e342-3f24-9340-f74e95e5322c","product":{"name":"libcrux-ed25519","vendor":{"name":"celabshq"}},"product_version":"0 \u003c0.0.6"}],"enisaIdVendor":[{"id":"920d8251-e79e-31d0-9a52-140149047c49","vendor":{"name":"celabshq"}}],"enisaIdVulnerability":[{"id":"a1f836a4-399e-3e3e-94dd-05b0a46e4783","vulnerability":{"id":"GHSA-xp2x-phr3-m4r9","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","datePublished":"Aug 19, 2026, 3:32:35 PM","dateUpdated":"Aug 19, 2026, 3:32:35 PM","baseScore":0.0,"references":"https://github.com/celabshq/libcrux/security/advisories/GHSA-435g-fcv3-8j26\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76234\nhttps://www.vulncheck.com/advisories/libcrux-before-cryptographic-implementation-bug-fixes\n","enisa_id":"EUVD-2026-62475\n","aliases":"GHSA-xp2x-phr3-m4r9\nCVE-2026-76234\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aa5e8596-3572-3bb1-8d46-a07534d6b6d0","vulnerability":{"id":"CVE-2026-76234","description":"libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.","datePublished":"Aug 19, 2026, 2:02:14 PM","dateUpdated":"Aug 21, 2026, 11:21:07 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/celabshq/libcrux/security/advisories/GHSA-435g-fcv3-8j26\nhttps://www.vulncheck.com/advisories/libcrux-before-cryptographic-implementation-bug-fixes\n","enisa_id":"EUVD-2026-62475\n","assigner":"VulnCheck","epss":0.31,"dataProcessed":"Oct 28, 2026, 7:14:21 AM","vulnerabilityProduct":[{"id":"60dd8bf1-6108-3925-8a5c-e44fa29bc551","product":{"name":"libcrux-psq","vendor":{"name":"celabshq"}},"product_version":"0 \u003c0.0.7"},{"id":"6937af2c-b65f-37a0-a7c5-e8c398600dc9","product":{"name":"libcrux-ecdh","vendor":{"name":"celabshq"}},"product_version":"0 \u003c0.0.6"},{"id":"70a8003e-9b81-3bf2-a5c7-86bcc6c8cc9a","product":{"name":"libcrux-ed25519","vendor":{"name":"celabshq"}},"product_version":"0 \u003c0.0.6"}],"vulnerabilityVendor":[{"id":"66f3df46-ddd7-3e08-8221-52bb1ed9929c","vendor":{"name":"celabshq"}}]}}],"enisaIdAdvisory":[]}