Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes: ## `libcrux-ecdh` - [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length ## `libcrux-ed25519` - [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation The issue fixed in #1320 was first reported by Nadim Kobeissi. ## `libcrux-psq` - [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking - [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys The issue fixed in #1319 was first reported by Nadim Kobeissi.

Source published

12 Feb 2026 22:12:14 UTC

Source modified

20 Aug 2026 04:03:48 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Publisher rating · LOW