AIKIDO-2026-10424

TL;DR

Affected versions of this package do not properly validate an user-controlled elliptic curve point during encapsulation and may panic when malformed input is provided instead of safely rejecting it. This can allow denial of service and may also expose the key agreement flow to invalid public point abuse if the untrusted point is used for shared secret derivation without strict validation. An attacker could exploit this by sending a crafted malicious point to trigger a panic and crash the application, or potentially manipulate cryptographic operations by supplying an invalid point designed to interfere with secret generation.