{"id":"RUSTSEC-2026-0238","revision":"bb05241d22ea4fa7824408cb38315d12","records":[{"revision":"bb05241d22ea4fa7824408cb38315d12","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0238","aliases":["GHSA-h9f2-fgp8-vc4h"],"title":"Low-level GCM ignores the operation nonce","description":"In all published versions of `dcrypt-algorithms` before 2.0.0, the low-level\n`Gcm` builder required an operation nonce but derived `J0` from the nonce\ncaptured by the original `Gcm` constructor. Multiple operations could therefore\nsilently reuse a nonce even when callers supplied distinct values, compromising\nconfidentiality and authenticity under an affected key.\n\nVersion 2.0.0 makes `Gcm` key-only and passes the operation nonce through IV\nderivation, encryption, and decryption. It also corrects non-96-bit IV\nprocessing, rejects tags shorter than 96 bits, and enforces counter limits.\nApplications must upgrade, identify affected keys, rotate them, and re-encrypt\naffected data; updating the implementation cannot restore security after nonce\nreuse.","state":0,"publishedAt":"2026-08-09T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:14.3070281+00:00","affected":[{"ecosystem":"crates.io","name":"dcrypt-algorithms","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"2.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/dcrypt-algorithms","https://rustsec.org/advisories/RUSTSEC-2026-0238.html","https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8","https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0238","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0238","identifiers":["RUSTSEC-2026-0238","GHSA-h9f2-fgp8-vc4h"]},"retained":false,"historicalAffected":[]}],"coverage":[]}