---
id: RUSTSEC-2026-0208
title: Potential Panic in AVX2 SHAKE-256
summary: Potential Panic in AVX2 SHAKE-256
severity: none
vendor: libcrux-sha3
product: libcrux-sha3
ecosystem: rust
affected:
  - 'libcrux-sha3 >= 0.0.0-0, < 0.0.10'
patched:
  - libcrux-sha3 0.0.10
published: '2026-05-21'
updated: '2026-07-17'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0208'
references:
  - url: 'https://crates.io/crates/libcrux-sha3'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0208.html'
  - url: 'https://github.com/celabshq/libcrux/pull/1456'
tags:
  - osv
  - rust
ingestedAt: '2026-07-17T19:00:52.067Z'
---

## Overview

The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.

## Impact
This bug impacts users on AVX2 platforms that use the
`libcrux_sha3::avx2::x4::shake256` API outside of ML-KEM or ML-DSA
with output buffers of length `> 32` and not divisible by `8`. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by `8`.

## Mitigation
Starting from version `0.0.10`, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths `> 32` that are not divisible by
`8`.

## Affected packages

- `libcrux-sha3 >= 0.0.0-0, < 0.0.10`

## Remediation

Upgrade to a patched release:

- `libcrux-sha3 0.0.10`