CVE-2026-76234: Improper Verification of Cryptographic Signature in celabshq libcrux-ecdh

This vulnerability involves cryptographic implementation bugs in celabshq's libcrux libraries. Specifically, libcrux-ecdh versions before 0.0.6 failed to properly validate the length and clamping of X25519 secret keys, including a broken clamping check for imported keys. libcrux-ed25519 performed an unnecessary duplicated clamping step during key generation, and libcrux-psq versions before 0.0.7 panicked instead of properly propagating an AEAD error. These flaws could undermine cryptographic assurances. The issues have been fixed in libcrux-ecdh 0.0.6 and libcrux-psq 0.0.7.

The improper verification of cryptographic signatures and key validation can lead to weakened cryptographic guarantees, potentially allowing attackers to bypass security mechanisms relying on these libraries. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector with no privileges or user interaction required and high impact on vulnerability assessment. No known exploits in the wild have been reported.

Users should upgrade libcrux-ecdh to version 0.0.6 or later and libcrux-psq to version 0.0.7 or later to address these vulnerabilities. Applying these official fixes will resolve the cryptographic implementation bugs. No additional mitigation steps are indicated by the vendor advisory.