{"id":"RUSTSEC-2023-0096","revision":null,"records":[{"revision":"45937a47e4cb4516b8b186cccd0cded5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2023-42811","aliases":[],"title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","state":0,"publishedAt":"2023-09-22T15:19:15.445+00:00","modifiedAt":"2025-06-18T14:22:56.534+00:00","affected":[{"ecosystem":"Vendor product","name":"AEADs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"RustCrypto\",\n                    \"product\": \"AEADs\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.10.0, < 0.10.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","score":4.7,"severity":"MEDIUM"}],"references":["https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq","https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-42811","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-42811","identifiers":["CVE-2023-42811"]},"retained":false,"historicalAffected":[]},{"revision":"4838f07bda644fa9af833029441d2712","observedAt":"2026-11-08T23:03:48.348+00:00","statement":{"source":"euvd","id":"EUVD-2023-2411","aliases":["CVE-2023-42811","GHSA-423w-p2w9-r7vq"],"title":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even …","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","score":4.7,"severity":null}],"references":["https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq","https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2411","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2023, 3:19:15 PM","dateUpdated":"Jun 18, 2025, 2:22:56 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2023:4060-1","title":"Security update for rage-encryption","vulnerabilityIds":["CVE-2023-42811"]},{"id":"openSUSE-SU-2024:13315-1","title":"shadowsocks-rust-1.16.2-1.1 on GA media","vulnerabilityIds":["CVE-2023-42811"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2023-2411","identifiers":["EUVD-2023-2411","CVE-2023-42811","GHSA-423w-p2w9-r7vq"]},"retained":false,"historicalAffected":[]},{"revision":"c40cdc7417264bb6b4365e50748b2c81","observedAt":"2026-10-24T22:17:27.792+00:00","statement":{"source":"nvd","id":"CVE-2023-42811","aliases":[],"title":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even …","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","state":0,"publishedAt":"2023-09-22T16:15:10.583+00:00","modifiedAt":"2026-06-17T06:24:34.02+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","score":4.7,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309","https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF/"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-42811","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-347"],"productCriteria":["cpe:2.3:a:aes-gcm_project:aes-gcm:*:*:*:*:*:rust:*:*","cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"sourceDates":{"published":"2023-09-22T16:15:10.583","lastModified":"2026-06-17T06:24:34.020"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2023-42811","identifiers":["CVE-2023-42811"]},"retained":false,"historicalAffected":[]},{"revision":"4a87662da1654e7081af6819eda6bdb3","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-423w-p2w9-r7vq","aliases":["CVE-2023-42811","RUSTSEC-2023-0096"],"title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"### Summary\nIn the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. \n\n### Impact\nIf a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery.\n\n### Details\nAs seen in the implementation of [decrypt_in_place_detached](https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309) for AES GCM, if the tag verification fails, an error is returned. Because the decryption of the ciphertext is done in place, the plaintext contents are now exposed via `buffer`. \n\nThis should ideally not be the case - as noted in page 17 of[ NIST's publication _Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC_](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf): \n_In Step 8, the result of Step 7 is compared with the authentication tag that was received as an input: if they are identical, then the plaintext is returned; otherwise,FAIL is returned._\n\nThis is seems correctly addressed in the [AES GCM SIV implementation](https://docs.rs/aes-gcm-siv/latest/src/aes_gcm_siv/lib.rs.html#307), where the decrypted buffer is encrypted again before the error is returned - this fix is straightforward to implement in AES GCM. To ensure that these types of cases are covered during testing, it would be valuable to add test cases like [23, 24 ](https://github.com/google/wycheproof/blob/master/testvectors/aes_gcm_test.json#L288)etc from [project wycheproof ](https://github.com/google/wycheproof)to ensure that when a bad tag is used, there is an error on decryption _**and**_ that the plaintext value is not exposed. \n\n### PoC\nTo reproduce this issue, I'm using [test case 23](https://github.com/google/wycheproof/blob/master/testvectors/aes_gcm_test.json#L288) from project wycheproof. \n```rust\n    let key = GenericArray::from_slice(&hex!(\"000102030405060708090a0b0c0d0e0f\"));\n    let nonce = GenericArray::from_slice(&hex!(\"505152535455565758595a5b\"));\n    let tag = GenericArray::from_slice(&hex!(\"d9847dbc326a06e988c77ad3863e6083\")); // bad tag\n    let mut ct = hex!(\"eb156d081ed6b6b55f4612f021d87b39\");\n    let msg = hex!(\"202122232425262728292a2b2c2d2e2f\");\n    let aad = hex!(\"\");\n    let cipher = Aes128Gcm::new(&key);\n    let _plaintext = cipher.decrypt_in_place_detached(&nonce, &aad, &mut ct, &tag);\n    assert_eq!(ct, msg);\n```","state":0,"publishedAt":"2023-09-22T16:11:47+00:00","modifiedAt":"2026-02-03T03:15:54.086216+00:00","affected":[{"ecosystem":"crates.io","name":"aes-gcm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.10.0"},{"kind":"fixed","version":"0.10.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq","https://nvd.nist.gov/vuln/detail/CVE-2023-42811","https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309","https://github.com/RustCrypto/AEADs","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF","https://rustsec.org/advisories/RUSTSEC-2023-0096.html"],"sourceUrl":"https://github.com/advisories/GHSA-423w-p2w9-r7vq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-423w-p2w9-r7vq","identifiers":["GHSA-423w-p2w9-r7vq","CVE-2023-42811","RUSTSEC-2023-0096"]},"retained":false,"historicalAffected":[]},{"revision":"b0158f74aaf442deab3aa0beca41a9ae","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2023-0096","aliases":["CVE-2023-42811","GHSA-423w-p2w9-r7vq"],"title":"Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"## Summary\n\nIn the AES GCM implementation of decrypt_in_place_detached,\nthe decrypted ciphertext (i.e. the correct plaintext) is\nexposed even if tag verification fails.\n\n## Impact\n\nIf a program using the aes-gcm crate's decrypt_in_place*\nAPIs accesses the buffer after decryption failure, it will\ncontain a decryption of an unauthenticated input. Depending\non the specific nature of the program this may enable\nChosen Ciphertext Attacks (CCAs) which can cause a\ncatastrophic breakage of the cipher including full\nplaintext recovery.\n\n## Details\n\nAs seen in the implementation of decrypt_in_place_detached for\nAES GCM, if the tag verification fails, an error is returned.\nBecause the decryption of the ciphertext is done in place,\nthe plaintext contents are now exposed via buffer.\n\nThis should ideally not be the case - as noted in page 17 of\nNIST's publication Recommendation for Block Cipher Modes of\nOperation: Galois/Counter Mode (GCM) and GMAC:\n\nIn Step 8, the result of Step 7 is compared with the\nauthentication tag that was received as an input: if\nthey are identical, then the plaintext is returned;\notherwise,FAIL is returned.\n\nThis is seems correctly addressed in the AES GCM SIV\nimplementation, where the decrypted buffer is encrypted\nagain before the error is returned - this fix is\nstraightforward to implement in AES GCM. To ensure that\nthese types of cases are covered during testing, it\nwould be valuable to add test cases like 23, 24 etc\nfrom project wycheproof to ensure that when a bad tag\nis used, there is an error on decryption and that the\nplaintext value is not exposed.\n\n## PoC\n\nTo reproduce this issue, I'm using test case 23 from\nproject wycheproof.\n\n```\n    let key = GenericArray::from_slice(&hex!(\"000102030405060708090a0b0c0d0e0f\"));\n    let nonce = GenericArray::from_slice(&hex!(\"505152535455565758595a5b\"));\n    let tag = GenericArray::from_slice(&hex!(\"d9847dbc326a06e988c77ad3863e6083\")); // bad tag\n    let mut ct = hex!(\"eb156d081ed6b6b55f4612f021d87b39\");\n    let msg = hex!(\"202122232425262728292a2b2c2d2e2f\");\n    let aad = hex!(\"\");\n    let cipher = Aes128Gcm::new(&key);\n    let _plaintext = cipher.decrypt_in_place_detached(&nonce, &aad, &mut ct, &tag);\n    assert_eq!(ct, msg);\n```","state":0,"publishedAt":"2023-11-22T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:05.8612488+00:00","affected":[{"ecosystem":"crates.io","name":"aes-gcm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.10.0"},{"kind":"fixed","version":"0.10.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/aes-gcm","https://rustsec.org/advisories/RUSTSEC-2023-0096.html","https://github.com/RustCrypto/AEADs/pull/551"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0096","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2023-0096","identifiers":["RUSTSEC-2023-0096","CVE-2023-42811","GHSA-423w-p2w9-r7vq"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4268898+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4268987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T10:21:22.8157744+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8157744+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T10:21:50.2500014+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4276529+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4276532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b0b0499af228434598651aa5d221386e","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T10:21:49.6403901+00:00","lastSuccessAt":"2026-11-10T10:21:49.637+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T10:21:49.637+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T10:21:23.1241572+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1241572+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T10:21:22.8858542+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8858542+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T10:21:23.1397622+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1397622+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T10:21:23.0142877+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.0142877+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}