AIKIDO-2026-875825

TL;DR

Before the fix, sha256Into fed the thread-local SHA-256 digest before validating the caller's output buffer and length, so a short buffer left the digest polluted and the thread's next hash was wrong; Sha256Midstate.digestInto wrote 32 bytes into any caller buffer, hasLeadingZeroBits returned true for negative counts and read past its state above 256 bits, and releasing one Sha256Pool hasher twice let two threads hash on a single digest. Any application code calling these public helpers with the arguments it controls triggers the flaws. The fix validates arguments before any hashing, bounds the bit count, and makes a double release a no-op.