Uncaught Exception Affecting libcrux-chacha20poly1305 package, versions <0.0.8

Q: How to fix?

Upgrade libcrux-chacha20poly1305 to version 0.0.8 or higher.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Uncaught Exception vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-RUST-LIBCRUXCHACHA20POLY1305-16689365
published14 May 2026
disclosed29 Mar 2026
creditUnknown

Report a new vulnerability Found a mistake?

Introduced: 29 Mar 2026

CWE-248 (opens in a new tab)

How to fix?

Upgrade libcrux-chacha20poly1305 to version 0.0.8 or higher.

Overview

Affected versions of this package are vulnerable to Uncaught Exception in the encrypt function. An attacker can cause a crash by supplying a ciphertext buffer longer than the expected ptxt.len() + TAG_LEN value, leading the application to panic when processing the buffer.

References

CVSS Base Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
Low
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
None
Integrity (VI)
None
Availability (VA)
High

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None