The vulnerability CVE-2026-76234 affects multiple components of the celabshq libcrux cryptographic libraries: libcrux-ecdh, libcrux-ed25519, and libcrux-psq. libcrux-ecdh failed to properly validate the length and clamping of X25519 secret keys and had a broken clamping check for imported keys. libcrux-ed25519 performed an unnecessary duplicated clamping step during key generation. libcrux-psq improperly handled errors by panicking instead of propagating an AEAD error. These cryptographic implementation bugs could undermine the security guarantees of the affected libraries. The issues have been fixed in the respective patched versions, although no explicit patch versions or vendor advisories are provided in the source data.

The improper verification and handling of cryptographic keys and signatures could lead to weakened cryptographic assurances, potentially allowing attackers to bypass security mechanisms relying on these libraries. The CVSS 4.0 base score of 8.7 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description notes that fixes exist in patched releases of libcrux-ecdh (>=0.0.6), libcrux-ed25519 (>=0.0.6), and libcrux-psq (>=0.0.7). Users should upgrade to these or later versions once confirmed. Until then, avoid using vulnerable versions. Monitor vendor communications for official patches and guidance.