GHSA-h9f2-fgp8-vc4h
Low-level GCM ignores the operation nonce
GHSA-h9f2-fgp8-vc4h is a vulnerability with no CVSS score yet in dcrypt-algorithms, published August 9, 2026. No source lists public exploit code. Fixed in dcrypt-algorithms 2.0.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.0dcrypt-algorithms
Description
In all published versions of dcrypt-algorithms before 2.0.0, the low-level
Gcm builder required an operation nonce but derived J0 from the nonce
captured by the original Gcm constructor. Multiple operations could therefore
silently reuse a nonce even when callers supplied distinct values, compromising
confidentiality and authenticity under an affected key.
Version 2.0.0 makes Gcm key-only and passes the operation nonce through IV
derivation, encryption, and decryption. It also corrects non-96-bit IV
processing, rejects tags shorter than 96 bits, and enforces counter limits.
Applications must upgrade, identify affected keys, rotate them, and re-encrypt
affected data; updating the implementation cannot restore security after nonce
reuse.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dcrypt-algorithmscrates.io | 0.0.0-0 up to 2.0.0 | 2.0.0 |
What each source reports
OSVRUSTSEC-2026-0238No score
Low-level GCM ignores the operation nonce
In all published versions of dcrypt-algorithms before 2.0.0, the low-level
Gcm builder required an operation nonce but derived J0 from the nonce
captured by the original Gcm constructor. Multiple operations could therefore
silently reuse a nonce even when callers supplied distinct values, compromising
confidentiality and authenticity under an affected key.
Version 2.0.0 makes Gcm key-only and passes the operation nonce through IV
derivation, encryption, and decryption. It also corrects non-96-bit IV
processing, rejects tags shorter than 96 bits, and enforces counter limits.
Applications must upgrade, identify affected keys, rotate them, and re-encrypt
affected data; updating the implementation cannot restore security after nonce
reuse.
- Record
RUSTSEC-2026-0238- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.