github.com
https://github.com/cryspen/libcrux GHSA-PV9V-5J35-XWCR
libcrux Panics During Standalone MAC Operations
Description
An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function `libcrux_poly1305::mac` to always panic with an out-of-bounds memory access. ## Impact Applications wishing to use libcrux-poly1305 as a standalone MAC would experience panics. The use of libcrux-poly1305 in libcrux-chacha20poly1305 is unaffected. ## Mitigation Starting from version `0.0.5`, the correct value is used for the key length constant.
Description source: GitHub Advisory
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
libcrux-poly1305Browse crates.io / libcrux-poly1305 | GitHub Advisory | Before 0.0.5 · Fixed in 0.0.5 | affected |
References
3github.com
https://github.com/cryspen/libcrux/pull/1351 rustsec.org
https://rustsec.org/advisories/RUSTSEC-2026-0073.html