https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:01:31 +0000 https://cve.radiocsirt.org/vuln/cve-2026-76234 <p><strong>Affected:</strong> celabshq libcrux-ecdh, celabshq libcrux-ed25519, celabshq libcrux-psq</p> <p>libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.</p> <p><strong>Affected:</strong> celabshq libcrux-ecdh, celabshq libcrux-ed25519, celabshq libcrux-psq</p> <p>libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.</p> https://cve.radiocsirt.org/vuln/cve-2026-76234 https://cve.radiocsirt.org/vuln/ghsa-435g-fcv3-8j26 <p><strong>Affected:</strong> crates.io: libcrux-ecdh, crates.io: libcrux-ed25519, crates.io: libcrux-psq</p> <p>In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:</p> <p>## `libcrux-ecdh`</p> <p>- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length</p> <p>## `libcrux-ed25519`</p> <p>- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation</p> <p>The issue fixed in #1320 was first reported by Nadim Kobeissi. ## `libcrux-psq`</p> <p>- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking - [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys</p> <p>The issue fixed in #1319 was first reported by Nadim Kobeissi.</p> <p><strong>Affected:</strong> crates.io: libcrux-ecdh, crates.io: libcrux-ed25519, crates.io: libcrux-psq</p> <p>In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:</p> <p>## `libcrux-ecdh`</p> <p>- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length</p> <p>## `libcrux-ed25519`</p> <p>- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation</p> <p>The issue fixed in #1320 was first reported by Nadim Kobeissi. ## `libcrux-psq`</p> <p>- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking - [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys</p> <p>The issue fixed in #1319 was first reported by Nadim Kobeissi.</p> https://cve.radiocsirt.org/vuln/ghsa-435g-fcv3-8j26