Rust advisories / libcrux-poly1305
Vulnerability HighRUSTSEC-2026-0073 · libcrux-poly1305
RUSTSEC-2026-0073: Panic in Standalone MAC Operations
Short answerA security vulnerability in the libcrux-poly1305 crate: Panic in Standalone MAC Operations. GitHub rates it High. Fixed in 0.0.5: update to a fixed version.
| Crate | libcrux-poly1305 |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.0.5. |
| Fixed in | 0.0.5 |
| Severity | High (GitHub rating) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| Published | 2026-03-04 |
| Last changed | 2026-03-27 |
| Also known as | GHSA-pv9v-5j35-xwcr |
| Affected functions | libcrux_poly1305::mac |
What to do
- See which version you have:
cargo tree -i libcrux-poly1305(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p libcrux-poly1305. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplelibcrux-poly1305 = "0.0.5") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function libcrux_poly1305::mac to always panic with an out-of-bounds memory access.
Impact
Applications wishing to use libcrux-poly1305 as a standalone MAC would experience panics. The use of libcrux-poly1305 in libcrux-chacha20poly1305 is unaffected.
Mitigation
Starting from version 0.0.5, the correct value is used for the key length constant.
References
- Package: crates.io/crates/libcrux-poly1305
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0073.html
- Web: github.com/cryspen/libcrux/pull/1351
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?