rustsec-2026-0209
Vulnerability from osv_rustsec
Published
2026-06-09 12:00
Modified
2026-07-17 11:34
Summary
AES-GCM did not enforce limits on AAD length
Details
NIST Special Publication 800-38D specifies that the bit length of the
AAD shall not exceed 2^64 - 1 bits. The implementation of AES-GCM in
libcrux-aesgcm neither enforced this limit for encryption nor for
decryption.
Impact
Use of AES-GCM with AAD of length exceeding the prescribed maximum length degrades the authentication security of the GCM tag.
Mitigation
Starting from version 0.0.9 (published as libcrux-aes@v0.0.9),
limits on the length of the AAD input are enforced, so overlong AAD
inputs result in an error on encryption and decryption.
Severity
References
{
"affected": [
{
"database_specific": {
"categories": [
"crypto-failure"
],
"cvss": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"libcrux_aesgcm::AesGcm128Key::decrypt",
"libcrux_aesgcm::AesGcm128Key::encrypt",
"libcrux_aesgcm::AesGcm256Key::decrypt",
"libcrux_aesgcm::AesGcm256Key::encrypt",
"libcrux_aesgcm::aes_gcm_128::AesGcm128::decrypt",
"libcrux_aesgcm::aes_gcm_128::AesGcm128::encrypt",
"libcrux_aesgcm::aes_gcm_128::Key::decrypt",
"libcrux_aesgcm::aes_gcm_128::Key::encrypt",
"libcrux_aesgcm::aes_gcm_128::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_128::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_128::neon::Key::decrypt",
"libcrux_aesgcm::aes_gcm_128::neon::Key::encrypt",
"libcrux_aesgcm::aes_gcm_128::neon::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_128::neon::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_128::neon::NeonAesGcm128::decrypt",
"libcrux_aesgcm::aes_gcm_128::neon::NeonAesGcm128::encrypt",
"libcrux_aesgcm::aes_gcm_128::portable::Key::decrypt",
"libcrux_aesgcm::aes_gcm_128::portable::Key::encrypt",
"libcrux_aesgcm::aes_gcm_128::portable::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_128::portable::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_128::portable::PortableAesGcm128::decrypt",
"libcrux_aesgcm::aes_gcm_128::portable::PortableAesGcm128::encrypt",
"libcrux_aesgcm::aes_gcm_128::x64::Key::decrypt",
"libcrux_aesgcm::aes_gcm_128::x64::Key::encrypt",
"libcrux_aesgcm::aes_gcm_128::x64::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_128::x64::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_128::x64::X64AesGcm128::decrypt",
"libcrux_aesgcm::aes_gcm_128::x64::X64AesGcm128::encrypt",
"libcrux_aesgcm::aes_gcm_256::AesGcm256::decrypt",
"libcrux_aesgcm::aes_gcm_256::AesGcm256::encrypt",
"libcrux_aesgcm::aes_gcm_256::Key::decrypt",
"libcrux_aesgcm::aes_gcm_256::Key::encrypt",
"libcrux_aesgcm::aes_gcm_256::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_256::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_256::neon::Key::decrypt",
"libcrux_aesgcm::aes_gcm_256::neon::Key::encrypt",
"libcrux_aesgcm::aes_gcm_256::neon::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_256::neon::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_256::neon::NeonAesGcm256::decrypt",
"libcrux_aesgcm::aes_gcm_256::neon::NeonAesGcm256::encrypt",
"libcrux_aesgcm::aes_gcm_256::portable::Key::decrypt",
"libcrux_aesgcm::aes_gcm_256::portable::Key::encrypt",
"libcrux_aesgcm::aes_gcm_256::portable::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_256::portable::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_256::portable::PortableAesGcm256::decrypt",
"libcrux_aesgcm::aes_gcm_256::portable::PortableAesGcm256::encrypt",
"libcrux_aesgcm::aes_gcm_256::x64::Key::decrypt",
"libcrux_aesgcm::aes_gcm_256::x64::Key::encrypt",
"libcrux_aesgcm::aes_gcm_256::x64::KeyRef::decrypt",
"libcrux_aesgcm::aes_gcm_256::x64::KeyRef::encrypt",
"libcrux_aesgcm::aes_gcm_256::x64::X64AesGcm256::decrypt",
"libcrux_aesgcm::aes_gcm_256::x64::X64AesGcm256::encrypt"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "libcrux-aesgcm",
"purl": "pkg:cargo/libcrux-aesgcm"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "NIST Special Publication 800-38D specifies that the bit length of the\nAAD shall not exceed `2^64 - 1` bits. The implementation of AES-GCM in\n`libcrux-aesgcm` neither enforced this limit for encryption nor for\ndecryption.\n\n## Impact\nUse of AES-GCM with AAD of length exceeding the prescribed maximum\nlength degrades the authentication security of the GCM tag.\n\n## Mitigation\nStarting from version `0.0.9` (published as `libcrux-aes@v0.0.9`),\nlimits on the length of the AAD input are enforced, so overlong AAD\ninputs result in an error on encryption and decryption.",
"id": "RUSTSEC-2026-0209",
"modified": "2026-07-17T11:34:24Z",
"published": "2026-06-09T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/libcrux-aesgcm"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0209.html"
},
{
"type": "WEB",
"url": "https://github.com/celabshq/libcrux/pull/1474"
}
],
"related": [],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AES-GCM did not enforce limits on AAD length"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…