RUSTSEC-2026-0072: 
Rust vulnerability analysis and mitigation

Computing an X25519 shared secret with x25519_dalek::StaticSecret::diffie_hellman does not include the check that the key exchange was contributory, i.e. does not ensure on its own that the resulting shared secret is non-zero.

Impact

RFC 9180 mandates that implementations of HPKE must check for all zero Diffie-Hellman shared secrets and abort if so. Applications using hpke-rs with the RustCryto provider would not perform this check allowing for non-contributive Diffie-Hellman shared secrets. Applications using hpke-rs with the libcrux provider are not affected.

Mitigation

Starting with version 0.6.0, an error will be returned when the computed Diffie-Hellman shared secret is all-zero.