RUSTSEC-2026-0208None▾ SunlitPotential Panic in AVX2 SHAKE-256
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
The AVX2-optimized implementation of SHAKE-256 intended for use in ML-KEM and ML-DSA would panic if the length of the output buffers was greater than 32 and not a multiple of 8, due to an out-of-bounds indexing operation.
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
libcrux-sha3 >= 0.0.0-0, < 0.0.10Upgrade to a patched release:
libcrux-sha3 0.0.10Connected by shared product, vendor, weakness, or advisory.