Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

libcrux-poly1305

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7crates.ioPublished

    libcrux Panics During Standalone MAC Operations

    GHSA-pv9v-5j35-xwcr

    Affected
    • crates.io libcrux-poly1305 < 0.0.5
    Fixed in
    0.0.5· Vendor fix available
    Issue
    An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function libcruxpoly1305::mac to always panic with an out-of-bounds memory access. Impact Applications wishing to use libcrux-poly1305 as a standalone MAC would experience panics. The use of libcrux-poly1305 in libcrux-chacha20poly1305 is unaffected. Mitigation Starting from version 0.0.5, the correct value is used for the key length constant.

    Recommended action: Upgrade to 0.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →