{"id":"RUSTSEC-2026-0207","title":"Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls","summary":"Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls","severity":"none","vendor":"libcrux-sha3","product":"libcrux-sha3","ecosystem":"rust","affected":["libcrux-sha3 >= 0.0.0-0, < 0.0.10"],"patched":["libcrux-sha3 0.0.10"],"published":"2026-04-22","updated":"2026-07-17","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0207","references":[{"url":"https://crates.io/crates/libcrux-sha3"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0207.html"},{"url":"https://github.com/celabshq/libcrux/pull/1389"}],"tags":["osv","rust"],"ingestedAt":"2026-07-17T19:00:52.046Z","slug":"RUSTSEC-2026-0207","body":"## Overview\n\nThe incremental squeeze functions in the portable SHAKE XOF API, when\nattempting to squeeze an output using multiple calls to `squeeze`,\nrather than squeezing the full output at once, could output incorrect\nvalues. Internally, output blocks that were not completely squeezed\nwere not buffered for the next call to `squeeze`, which would\nconsequently drop bytes of the correct squeeze output if the preceding\ncall requested an output of length in bytes not cleanly divisible by\n`RATE` (168 for SHAKE128, 136 for SHAKE256).\n\n## Impact\nThis bug impacts users that rely on this XOF API to squeeze output in\nmultiple calls where any of the calls request an output length that is\nnot divisible by `RATE`. It does not impact the use of libcrux-sha3 in\nlibcrux-ml-kem or libcrux-ml-dsa.\n\n## Mitigation\nStarting from version `0.0.10` the squeeze functions correctly output\nall squeezed bytes independent of the number of `squeeze` calls and\nthe output lengths requested in each call.\n\n## Affected packages\n\n- `libcrux-sha3 >= 0.0.0-0, < 0.0.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `libcrux-sha3 0.0.10`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}