Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
libcrux-aesgcm AES Decryption May Reveal Sensitive Data
published 3 months ago
Summary
The libcrux-aesgcm library may leak information about encrypted data when used in certain situations. This could allow an attacker to forge new encrypted messages. If you use this library, update to version 0.0.9 or later to minimize this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| crates.io | franziskuskiefer | libcrux-aesgcm | >= 0.0.0-0 |
Original advisory text
Non-constant time Authentication Tag Check in AES-GCM Decryption
AES-GCM decryption used an implementation for checking the provided
authentication tag against the recomputed authentication tag that was
intended to be constant-time, but resulted in non-constant-time code
generation in certain circumstances.
Note that `libcrux-aesgcm` does not give guarantees on constant-time
code generation and possible mitigations must be considered
on a best-effort basis.
## Impact
Users of `libcrux-aesgcm` that expose a decryption oracle to an
attacker, which allows repeatedly querying for the same ciphertext
were at risk from timing side-channel attacks, depending on their
compilation environment. In the worst case, this could lead to
recovery of the recomputed authentication tag by the attacker, which
enables ciphertext forgery.
## Mitigation
Starting from version `0.0.9` (published as `[email protected]`),
AES-GCM decryption uses a different, best-effort constant-time
implementation of the tag check, which has been checked to reliably
lead to constant time code generation, at the moment.
authentication tag against the recomputed authentication tag that was
intended to be constant-time, but resulted in non-constant-time code
generation in certain circumstances.
Note that `libcrux-aesgcm` does not give guarantees on constant-time
code generation and possible mitigations must be considered
on a best-effort basis.
## Impact
Users of `libcrux-aesgcm` that expose a decryption oracle to an
attacker, which allows repeatedly querying for the same ciphertext
were at risk from timing side-channel attacks, depending on their
compilation environment. In the worst case, this could lead to
recovery of the recomputed authentication tag by the attacker, which
enables ciphertext forgery.
## Mitigation
Starting from version `0.0.9` (published as `[email protected]`),
AES-GCM decryption uses a different, best-effort constant-time
implementation of the tag check, which has been checked to reliably
lead to constant time code generation, at the moment.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 Jul 2026
Updated17 Jul 2026
First seen17 Jul 2026
Sources
RUSTSEC-2026-0211 · OSV
Track software like this
Free during beta