GHSA-pv9v-5j35-xwcr: libcrux Panics During Standalone MAC Operations

March 26, 2026

An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function libcrux_poly1305::mac to always panic with an out-of-bounds memory access.

References

github.com/advisories/GHSA-pv9v-5j35-xwcr
github.com/cryspen/libcrux
github.com/cryspen/libcrux/pull/1351
rustsec.org/advisories/RUSTSEC-2026-0073.html

Code Behaviors & Features

Detect and mitigate GHSA-pv9v-5j35-xwcr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →