RUSTSEC-2026-0211
Non-constant time Authentication Tag Check in AES-GCM Decryption
AES-GCM decryption used an implementation for checking the provided
authentication tag against the recomputed authentication tag that was
intended to be constant-time, but resulted in non-constant-time code
generation in certain circumstances.
Note that libcrux-aesgcm does not give guarantees on constant-time
code generation and possible mitigations must be considered
on a best-effort basis.
Impact
Users of libcrux-aesgcm that expose a decryption oracle to an
attacker, which allows repeatedly querying for the same ciphertext
were at risk from timing side-channel attacks, depending on their
compilation environment. In the worst case, this could lead to
recovery of the recomputed authentication tag by the attacker, which
enables ciphertext forgery.
Mitigation
Starting from version 0.0.9 (published as [email protected]),
AES-GCM decryption uses a different, best-effort constant-time
implementation of the tag check, which has been checked to reliably
lead to constant time code generation, at the moment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
OSV Score used
Non-constant time Authentication Tag Check in AES-GCM Decryption
AES-GCM decryption used an implementation for checking the provided
authentication tag against the recomputed authentication tag that was
intended to be constant-time, but resulted in non-constant-time code
generation in certain circumstances.
Note that libcrux-aesgcm does not give guarantees on constant-time
code generation and possible mitigations must be considered
on a best-effort basis.
Impact
Users of libcrux-aesgcm that expose a decryption oracle to an
attacker, which allows repeatedly querying for the same ciphertext
were at risk from timing side-channel attacks, depending on their
compilation environment. In the worst case, this could lead to
recovery of the recomputed authentication tag by the attacker, which
enables ciphertext forgery.
Mitigation
Starting from version 0.0.9 (published as [email protected]),
AES-GCM decryption uses a different, best-effort constant-time
implementation of the tag check, which has been checked to reliably
lead to constant time code generation, at the moment.
- Record
RUSTSEC-2026-0211- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcrux-aesgcmcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0211 is a medium vulnerability (CVSS 6.3) in libcrux-aesgcm, published July 14, 2026. No source lists public exploit code. No source names a fixed version.