CVE-2026-76234
Description
A flaw was found in the libcrux cryptographic libraries, including libcrux-ecdh, libcrux-ed25519, and libcrux-psq. These libraries contain implementation errors that could lead to a denial of service, where an application using the affected components might become unavailable. Specifically, libcrux-psq could terminate unexpectedly instead of handling cryptographic errors gracefully. Other issues involve incorrect validation of cryptographic secrets and redundant steps during key generation, which could potentially weaken the security of cryptographic operations.
Statement
Red Hat rates this flaw as Important because an unauthenticated remote attacker can cause a denial of service or undermine cryptographic operations with no prior privileges. In affected applications processing untrusted network traffic, unhandled library panics can terminate the hosting process and halt availability. Standard Red Hat Enterprise Linux installations do not package or expose libcrux by default, confining the risk to environments that specifically build or deploy applications against these libraries.
Understanding the Weakness (CWE)
Other,Integrity,Availability
Technical Impact: Varies by Context; DoS: Resource Consumption (CPU); Modify Memory; Read Memory
When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
