Advisories for libcrux releases in October 2026

[jschneider-bensch]

Affected crate(s)

• libcrux-kem (1,600,879 downloads in the last 90 days)
• libcrux-hmac-drbg (74,773 downloads in the last 90 days)

Links to upstream issue(s) or PR(s)

• libcrux-kem 0: [kem] Reject short seed lengths for hybrid encapsulation & Fix MlKem512 Ss variant celabshq/libcrux#1595
• libcrux-kem 1: [kem] Reject invalid hybrid key lengths without panicking celabshq/libcrux#1560
• libcrux-hmac-drbg: [hmac-drbg]: fix panic in reseeding wrappers fill_bytes method celabshq/libcrux#1558

Severity

• libcrux-kem 0: A potential panic in key encapsulation with an untrusted encapsulation seed. An application should not use untrusted encapsulation seeds in the first place, nevertheless it should not panic on a malformed input.
• libcrux-kem 1: A potential panic in deserialization of KEM public and private keys, so this is an availability issue for applications that deserialize untrusted key material.
• libcrux-hmac-drbg: A panic on sampling randomness into buffers of certain lengths. This can be an availability issue for applications where the amount of bytes to be sampled precisely in one go is under attacker control.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate