{"uuid": "39ff06dc-33d4-4d17-86f9-d4e1ee5fdfba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-HC3C-63HC-2R9F", "type": "seen", "source": "https://gist.github.com/alon710/c4a860134b6110f10b39bc6e4ccfdea2", "content": "# GHSA-HC3C-63HC-2R9F: GHSA-HC3C-63HC-2R9F: Denial of Service via Uncaught Exception in libcrux-chacha20poly1305\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-05-19\n> **Full Report:** https://cvereports.com/reports/GHSA-HC3C-63HC-2R9F\n\n## Summary\nThe libcrux-chacha20poly1305 cryptographic crate contains a Denial of Service vulnerability triggered by providing an overlong ciphertext buffer during encryption. This flaw manifests as a runtime panic due to an improper slice conversion, allowing attackers to terminate the application if buffer sizes are user-influenced.\n\n## TL;DR\nA missing length bound check in the libcrux-chacha20poly1305 encrypt function causes an unhandled panic when the provided destination buffer exceeds the required size. This leads to a Denial of Service via application termination.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248, CWE-20\n- **Attack Vector**: Network / Local\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- Rust applications utilizing libcrux-chacha20poly1305 versions <= 0.0.7 for encryption tasks\n- **libcrux-chacha20poly1305**: <= 0.0.7 (Fixed in: `0.0.8`)\n\n## Mitigation\n\n- Update the libcrux-chacha20poly1305 dependency to version 0.0.8 or newer\n- Manually truncate the ciphertext destination buffer to exactly plaintext length + 16 bytes before calling the encrypt function\n\n**Remediation Steps:**\n1. Identify all projects utilizing the libcrux-chacha20poly1305 crate\n2. Modify Cargo.toml to enforce version requirements of 0.0.8 or higher\n3. Run `cargo update -p libcrux-chacha20poly1305` to pull the latest patch\n4. Audit application source code for fixed-size buffer allocations passed to AEAD endpoints\n5. Recompile and deploy the updated application binaries\n\n## References\n\n- [GitHub Advisory: GHSA-HC3C-63HC-2R9F](https://github.com/advisories/GHSA-HC3C-63HC-2R9F)\n- [RustSec Advisory: RUSTSEC-2026-0124](https://rustsec.org/advisories/RUSTSEC-2026-0124.html)\n- [Cryspen libcrux Pull Request #1386](https://github.com/cryspen/libcrux/pull/1386)\n- [Cryspen libcrux Official Repository](https://github.com/cryspen/libcrux)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HC3C-63HC-2R9F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-19T18:10:50.000000Z"}