Improper Validation of Array Index Affecting libcrux-sha3 package, versions <0.0.10
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-LIBCRUXSHA3-18017884
- published19 Jul 2026
- disclosed21 May 2026
- creditUnknown
Introduced: 21 May 2026
CVE NOT AVAILABLE CWE-129 (opens in a new tab)How to fix?
Upgrade libcrux-sha3 to version 0.0.10 or higher.
Overview
Affected versions of this package are vulnerable to Improper Validation of Array Index in the libcrux_sha3::avx2::x4::shake256 function when the output buffer length exceeds 32 and is not a multiple of 8, leading to an out-of-bounds indexing operation. An attacker can cause a panic and potentially disrupt service by providing specially crafted output buffer lengths. This is only exploitable if the code is running on AVX2 platforms and the API is used outside of ML-KEM or ML-DSA with output buffer lengths greater than 32 and not divisible by 8.
Workaround
This vulnerability can be mitigated by ensuring output buffer lengths are always divisible by 8 when using the affected API.