Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76234libcrux before 0.0.6 Cryptographic Implementation Bug Fixes

High 7.5

In plain English

A high-severity security flaw in libcrux-ecdh from celabshq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.

Affected products (as reported)

Vendor	Product	Versions
celabshq	libcrux-ecdh	0 – before 0.0.6
celabshq	libcrux-ed25519	0 – before 0.0.6
celabshq	libcrux-psq	0 – before 0.0.7

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-435g-fcv3-8j26) vendor-advisory
VulnCheck Advisory: libcrux before 0.0.6 Cryptographic Implementation Bug Fixes third-party-advisory