{"id":"RUSTSEC-2026-0208","title":"Potential Panic in AVX2 SHAKE-256","summary":"Potential Panic in AVX2 SHAKE-256","severity":"none","vendor":"libcrux-sha3","product":"libcrux-sha3","ecosystem":"rust","affected":["libcrux-sha3 >= 0.0.0-0, < 0.0.10"],"patched":["libcrux-sha3 0.0.10"],"published":"2026-05-21","updated":"2026-07-17","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0208","references":[{"url":"https://crates.io/crates/libcrux-sha3"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0208.html"},{"url":"https://github.com/celabshq/libcrux/pull/1456"}],"tags":["osv","rust"],"ingestedAt":"2026-07-17T19:00:52.067Z","slug":"RUSTSEC-2026-0208","body":"## Overview\n\nThe AVX2-optimized implementation of SHAKE-256 intended for use in\nML-KEM and ML-DSA would panic if the length of the output buffers was\ngreater than 32 and not a multiple of 8, due to an out-of-bounds\nindexing operation.\n\n## Impact\nThis bug impacts users on AVX2 platforms that use the\n`libcrux_sha3::avx2::x4::shake256` API outside of ML-KEM or ML-DSA\nwith output buffers of length `> 32` and not divisible by `8`. It does\nnot impact the use in ML-KEM or ML-DSA because there output buffer\nlengths are always divisible by `8`.\n\n## Mitigation\nStarting from version `0.0.10`, the AVX2-optimized SHAKE-256 will no\nlonger panic on output buffer lengths `> 32` that are not divisible by\n`8`.\n\n## Affected packages\n\n- `libcrux-sha3 >= 0.0.0-0, < 0.0.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `libcrux-sha3 0.0.10`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}