The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.
The AVX2-optimized implementation of SHAKE-256 intended for use in
ML-KEM and ML-DSA would panic if the length of the output buffers was
greater than 32 and not a multiple of 8, due to an out-of-bounds
indexing operation.
Impact
This bug impacts users on AVX2 platforms that use the
libcrux_sha3::avx2::x4::shake256 API outside of ML-KEM or ML-DSA
with output buffers of length > 32 and not divisible by 8. It does
not impact the use in ML-KEM or ML-DSA because there output buffer
lengths are always divisible by 8.
Mitigation
Starting from version 0.0.10, the AVX2-optimized SHAKE-256 will no
longer panic on output buffer lengths > 32 that are not divisible by
8.
Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when
attempting to squeeze an output using multiple calls to squeeze,
rather than squeezing the full output at once, could output incorrect
values. Internally, output blocks that were not completely squeezed
were not buffered for the next call to squeeze, which would
consequently drop bytes of the correct squeeze output if the preceding
call requested an output of length in bytes not cleanly divisible by
RATE (168 for SHAKE128, 136 for SHAKE256).
Impact
This bug impacts users that rely on this XOF API to squeeze output in
multiple calls where any of the calls request an output length that is
not divisible by RATE. It does not impact the use of libcrux-sha3 in
libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.10 the squeeze functions correctly output
all squeezed bytes independent of the number of squeeze calls and
the output lengths requested in each call.
GHSA-q29p-9pfr-j652
RUSTSEC-2026-0074
Mar 26, 2026
libcrux-sha3: Incorrect output from SHAKE squeeze functions
High
Network
Low
None
None
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF output.
Impact
This bug impacts users that rely on this XOF API to squeeze more than RATE bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa.
Mitigation
Starting from version 0.0.8 the squeeze functions correctly output all blocks including the first block.