RUSTSEC-2026-0208: Potential Panic in AVX2 SHAKE-256

What to do

1. See which version you have: cargo tree -i libcrux-sha3 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p libcrux-sha3. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example libcrux-sha3 = "0.0.10") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The AVX2-optimized implementation of SHAKE-256 intended for use in ML-KEM and ML-DSA would panic if the length of the output buffers was greater than 32 and not a multiple of 8, due to an out-of-bounds indexing operation.

Impact

This bug impacts users on AVX2 platforms that use the libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA with output buffers of length > 32 and not divisible by 8. It does not impact the use in ML-KEM or ML-DSA because there output buffer lengths are always divisible by 8.

Mitigation

Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no longer panic on output buffer lengths > 32 that are not divisible by 8.

References

• Package: crates.io/crates/libcrux-sha3
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0208.html
• Web: github.com/celabshq/libcrux/pull/1456

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for libcrux-sha3

• VulnerabilityRUSTSEC-2026-0074 · 2026-03-04Incorrect Output of Incremental Portable SHAKE API
• VulnerabilityRUSTSEC-2026-0207 · 2026-04-22Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls

Full security history of libcrux-sha3