{"id":"GHSA-g433-pq76-6cmf","aliases":["RUSTSEC-2026-0069","RUSTSEC-2026-0070","RUSTSEC-2026-0071","RUSTSEC-2026-0072"],"status":"published","title":"Bug fixes in hpke-rs, hpke-rs-rust-crypto","description":"We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:\n\n## hpke-rs\n- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom\u003cu16\u003e` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.\n- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.\n- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)\n\nThe issue fixed in #123 was first reported by Nadim Kobeissi.\nThe issues fixed in #127 and #128 were first reported by Scott Arciszewski.\n\n## hpke-rs-rust-crypto\n- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys\n\nThe issue fixed in #124 was first reported by Nadim Kobeissi.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-20","CWE-697"],"published":"2026-02-04T12:00:00Z","modified":"2026-03-25T21:48:54Z","fixes":[{"ecosystem":"crates.io","package":"hpke-rs","fixed_in":["0.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"crates.io","package":"hpke-rs-rust-crypto","fixed_in":["0.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hpke-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"hpke-rs-rust-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpke-rs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpke-rs-rust-crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpke-rs","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpke-rs","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpke-rs","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hpke-rs-rust-crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]}],"references":[{"url":"https://github.com/cryspen/hpke-rs/security/advisories/GHSA-g433-pq76-6cmf","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/pull/123","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/pull/124","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/pull/127","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/pull/128","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/commit/1c247b5c9aeca602ad2971c9bd49817fe2c308e6","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/commit/25248bd624cc0325c98a05c169a0c9aa0aced632","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/commit/3a8254938f43bdc4e0c9c4f987f8071f19779066","tags":["web"]},{"url":"https://github.com/cryspen/hpke-rs/commit/b54c8bb83906331bdf4f606cafa30cd7fd20b531","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0070.html","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0072.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g433-pq76-6cmf"},{"url":"https://github.com/cryspen/hpke-rs","tags":["package"]},{"url":"https://crates.io/crates/hpke-rs","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0069.html","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0071.html","tags":["advisory"]},{"url":"https://crates.io/crates/hpke-rs-rust-crypto","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g433-pq76-6cmf","title":"Bug fixes in hpke-rs, hpke-rs-rust-crypto","description":"We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:\n\n## hpke-rs\n- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom\u003cu16\u003e` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.\n- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.\n- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)\n\nThe issue fixed in #123 was first reported by Nadim Kobeissi.\nThe issues fixed in #127 and #128 were first reported by Scott Arciszewski.\n\n## hpke-rs-rust-crypto\n- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys\n\nThe issue fixed in #124 was first reported by Nadim Kobeissi.","status":"published","published":"2026-02-13T20:05:10Z","modified":"2026-03-25T21:37:23Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20","CWE-190","CWE-697"],"updated_at":"2026-11-02T14:39:42.712607Z"}],"osv":[{"id":"GHSA-g433-pq76-6cmf","title":"Bug fixes in hpke-rs, hpke-rs-rust-crypto","description":"We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:\n\n## hpke-rs\n- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom\u003cu16\u003e` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.\n- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.\n- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)\n\nThe issue fixed in #123 was first reported by Nadim Kobeissi.\nThe issues fixed in #127 and #128 were first reported by Scott Arciszewski.\n\n## hpke-rs-rust-crypto\n- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys\n\nThe issue fixed in #124 was first reported by Nadim Kobeissi.","status":"published","published":"2026-02-13T20:05:10Z","modified":"2026-03-25T21:48:54.711298Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-190","CWE-20","CWE-697"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RUSTSEC-2026-0070","title":"Panic When Opening or Sealing on Export-Only Context","description":"Constructing an HPKE Context with the AEAD algorithm set to\n`HpkeExport` resulted in a panic when calling `Context::seal`, or\n`Context::open`. This was due to an underflowing integer subtraction\nwhen calculating the length of a vector allocation for the AEAD nonce,\nwhich would panic on its own in debug mode and cause out-of-memory\nabort on the allocation in release mode.\n\n## Impact\nApplications that could be made to use an HPKE context configured with\n`HpkeExport` as AEAD algorithm to open or seal a ciphertext would\ncrash. Other applications are unaffected.\n\n## Mitigation\nStarting with version `0.6.0`, an error will be returned when\nattempting to call `Context::seal` or `Context::open` on an HPKE\ncontext with `HpkeExport` as AEADAlgorithm.","status":"published","published":"2026-02-11T12:00:00Z","modified":"2026-03-24T08:41:23.142103Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0071","title":"Nonce Reuse in HPKE Context","description":"The sequence number that is used to compute the AEAD nonce when using\na re-usable HPKE context is incremented after each seal or open\noperation. This sequence number was stored as a `u32` and used regular\naddition on `u32` for the increment, meaning in release mode it would\nsilently wrap around to 0 after 2^32 seal or open operations.\n\n## Impact\nNonce reuse causes catastrophic breakage of AEAD ciphers, enabling\nplaintext recovery attacks and authentication tag forgeries, depending\non the concrete AEAD.\n\nThis bug impacts applications that use hpke-rs to encrypt a large\nnumber of messages using the same context. Applications using the\none-shot APIs are unaffected.\n\n## Mitigation\nStarting with version `0.6.0`, `checked_add` is used to increment the\nsequence number, which avoids a silent wraparound in release\nmode. Additionally, the sequence number is now stored as a `u64`,\nincreasing the maximally allowed number of seal and open operations on\na given HPKE context.","status":"published","published":"2026-02-05T12:00:00Z","modified":"2026-03-24T08:41:23.142103Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0069","title":"Incorrect Length Encoding on KDF Export","description":"Passing values `length \u003e 65535` to `Context::export` produces output\nthat disagrees with the RFC 9180 label encoding. In particular the\nlength value is cast to `u16` truncating any value exceeding\n65535.\n\n## Impact\nApplications that use hpke-rs to export very large secrets would\nexperience interoperability issues with other applications that use a\ncorrect implementation to export very large secrets.\n\n## Mitigation\nStarting with version `0.6.0`, an error will be returned when\nattempting to call `Context::export` with an output length \u003e 65535.","status":"published","published":"2026-02-11T12:00:00Z","modified":"2026-03-24T08:41:23.142103Z","updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0072","title":"Missing Check for All-Zero X25519 Shared Secret","description":"Computing an X25519 shared secret with\n`x25519_dalek::StaticSecret::diffie_hellman` does not include the\ncheck that the key exchange was contributory, i.e. does not ensure on\nits own that the resulting shared secret is non-zero.\n\n## Impact\nRFC 9180 mandates that implementations of HPKE must check for all zero\nDiffie-Hellman shared secrets and abort if so.\n\nApplications using hpke-rs with the RustCryto provider would not\nperform this check allowing for non-contributive Diffie-Hellman shared\nsecrets. Applications using hpke-rs with the libcrux provider are not\naffected.\n\n## Mitigation\nStarting with version `0.6.0`, an error will be returned when\nthe computed Diffie-Hellman shared secret is all-zero.","status":"published","published":"2026-02-04T12:00:00Z","modified":"2026-03-24T08:41:23.142103Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}