Vulnerability-Lookup

GHSA-G433-PQ76-6CMF

Vulnerability from github – Published: 2026-02-13 20:05 – Updated: 2026-03-25 21:37

Summary

Bug fixes in hpke-rs, hpke-rs-rust-crypto

Details

We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:

hpke-rs

#127: Fix KemAlgorithm::TryFrom<u16> mapping where 0x004D incorrectly resolved to XWingDraft06 instead of XWingDraft06Obsolete.
#123: Fix potential overflow in context counter and switch to use u64.
#128: Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)

The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski.

hpke-rs-rust-crypto

#124: Error out on x25519 0 keys

The issue fixed in #124 was first reported by Nadim Kobeissi.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "hpke-rs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "hpke-rs-rust-crypto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-20",
      "CWE-697"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-13T20:05:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:\n\n## hpke-rs\n- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom\u003cu16\u003e` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.\n- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.\n- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that\u0027s too long (instead of truncating it)\n\nThe issue fixed in #123 was first reported by Nadim Kobeissi.\nThe issues fixed in #127 and #128 were first reported by Scott Arciszewski.\n\n## hpke-rs-rust-crypto\n- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys\n\nThe issue fixed in #124 was first reported by Nadim Kobeissi.",
  "id": "GHSA-g433-pq76-6cmf",
  "modified": "2026-03-25T21:37:22Z",
  "published": "2026-02-13T20:05:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/security/advisories/GHSA-g433-pq76-6cmf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/123"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/124"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/commit/1c247b5c9aeca602ad2971c9bd49817fe2c308e6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/commit/25248bd624cc0325c98a05c169a0c9aa0aced632"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/commit/3a8254938f43bdc4e0c9c4f987f8071f19779066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/commit/b54c8bb83906331bdf4f606cafa30cd7fd20b531"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cryspen/hpke-rs"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0070.html"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0072.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Bug fixes in hpke-rs, hpke-rs-rust-crypto"
}

RUSTSEC-2026-0069 (GHSA-G433-PQ76-6CMF)

Vulnerability from osv_rustsec – Published: 2026-02-11 12:00 – Updated: 2026-03-24 08:16 – Source website

Summary

Incorrect Length Encoding on KDF Export

Details

Passing values length > 65535 to Context::export produces output that disagrees with the RFC 9180 label encoding. In particular the length value is cast to u16 truncating any value exceeding 65535.

Impact

Applications that use hpke-rs to export very large secrets would experience interoperability issues with other applications that use a correct implementation to export very large secrets.

Mitigation

Starting with version 0.6.0, an error will be returned when attempting to call Context::export with an output length > 65535.

References

URL

Type

	https://crates.io/crates/hpke-rs	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0069.html	ADVISORY
	https://github.com/cryspen/hpke-rs/pull/128	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "hpke_rs::Context::export"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "hpke-rs",
        "purl": "pkg:cargo/hpke-rs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-g433-pq76-6cmf"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Passing values `length \u003e 65535` to `Context::export` produces output\nthat disagrees with the RFC 9180 label encoding. In particular the\nlength value is cast to `u16` truncating any value exceeding\n65535.\n\n## Impact\nApplications that use hpke-rs to export very large secrets would\nexperience interoperability issues with other applications that use a\ncorrect implementation to export very large secrets.\n\n## Mitigation\nStarting with version `0.6.0`, an error will be returned when\nattempting to call `Context::export` with an output length \u003e 65535.",
  "id": "RUSTSEC-2026-0069",
  "modified": "2026-03-24T08:16:07Z",
  "published": "2026-02-11T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hpke-rs"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0069.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/128"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Incorrect Length Encoding on KDF Export"
}

RUSTSEC-2026-0070 (GHSA-G433-PQ76-6CMF)

Vulnerability from osv_rustsec – Published: 2026-02-11 12:00 – Updated: 2026-03-24 08:16 – Source website

Summary

Panic When Opening or Sealing on Export-Only Context

Details

Constructing an HPKE Context with the AEAD algorithm set to HpkeExport resulted in a panic when calling Context::seal, or Context::open. This was due to an underflowing integer subtraction when calculating the length of a vector allocation for the AEAD nonce, which would panic on its own in debug mode and cause out-of-memory abort on the allocation in release mode.

Impact

Applications that could be made to use an HPKE context configured with HpkeExport as AEAD algorithm to open or seal a ciphertext would crash. Other applications are unaffected.

Mitigation

Starting with version 0.6.0, an error will be returned when attempting to call Context::seal or Context::open on an HPKE context with HpkeExport as AEADAlgorithm.

Severity

8.2 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

URL

Type

	https://crates.io/crates/hpke-rs	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0070.html	ADVISORY
	https://github.com/cryspen/hpke-rs/pull/128	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "hpke_rs::Context::open",
            "hpke_rs::Context::seal"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "hpke-rs",
        "purl": "pkg:cargo/hpke-rs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-g433-pq76-6cmf"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Constructing an HPKE Context with the AEAD algorithm set to\n`HpkeExport` resulted in a panic when calling `Context::seal`, or\n`Context::open`. This was due to an underflowing integer subtraction\nwhen calculating the length of a vector allocation for the AEAD nonce,\nwhich would panic on its own in debug mode and cause out-of-memory\nabort on the allocation in release mode.\n\n## Impact\nApplications that could be made to use an HPKE context configured with\n`HpkeExport` as AEAD algorithm to open or seal a ciphertext would\ncrash. Other applications are unaffected.\n\n## Mitigation\nStarting with version `0.6.0`, an error will be returned when\nattempting to call `Context::seal` or `Context::open` on an HPKE\ncontext with `HpkeExport` as AEADAlgorithm.",
  "id": "RUSTSEC-2026-0070",
  "modified": "2026-03-24T08:16:07Z",
  "published": "2026-02-11T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hpke-rs"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0070.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/128"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Panic When Opening or Sealing on Export-Only Context"
}

RUSTSEC-2026-0071 (GHSA-G433-PQ76-6CMF)

Vulnerability from osv_rustsec – Published: 2026-02-05 12:00 – Updated: 2026-03-24 08:16 – Source website

Summary

Nonce Reuse in HPKE Context

Details

The sequence number that is used to compute the AEAD nonce when using a re-usable HPKE context is incremented after each seal or open operation. This sequence number was stored as a u32 and used regular addition on u32 for the increment, meaning in release mode it would silently wrap around to 0 after 2^32 seal or open operations.

Impact

Nonce reuse causes catastrophic breakage of AEAD ciphers, enabling plaintext recovery attacks and authentication tag forgeries, depending on the concrete AEAD.

This bug impacts applications that use hpke-rs to encrypt a large number of messages using the same context. Applications using the one-shot APIs are unaffected.

Mitigation

Starting with version 0.6.0, checked_add is used to increment the sequence number, which avoids a silent wraparound in release mode. Additionally, the sequence number is now stored as a u64, increasing the maximally allowed number of seal and open operations on a given HPKE context.

Severity

9.3 (Critical)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

URL

Type

	https://crates.io/crates/hpke-rs	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0071.html	ADVISORY
	https://github.com/cryspen/hpke-rs/pull/123	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "hpke_rs::Context::open",
            "hpke_rs::Context::seal"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "hpke-rs",
        "purl": "pkg:cargo/hpke-rs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-g433-pq76-6cmf"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The sequence number that is used to compute the AEAD nonce when using\na re-usable HPKE context is incremented after each seal or open\noperation. This sequence number was stored as a `u32` and used regular\naddition on `u32` for the increment, meaning in release mode it would\nsilently wrap around to 0 after 2^32 seal or open operations.\n\n## Impact\nNonce reuse causes catastrophic breakage of AEAD ciphers, enabling\nplaintext recovery attacks and authentication tag forgeries, depending\non the concrete AEAD.\n\nThis bug impacts applications that use hpke-rs to encrypt a large\nnumber of messages using the same context. Applications using the\none-shot APIs are unaffected.\n\n## Mitigation\nStarting with version `0.6.0`, `checked_add` is used to increment the\nsequence number, which avoids a silent wraparound in release\nmode. Additionally, the sequence number is now stored as a `u64`,\nincreasing the maximally allowed number of seal and open operations on\na given HPKE context.",
  "id": "RUSTSEC-2026-0071",
  "modified": "2026-03-24T08:16:07Z",
  "published": "2026-02-05T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hpke-rs"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0071.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/123"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nonce Reuse in HPKE Context"
}

RUSTSEC-2026-0072 (GHSA-G433-PQ76-6CMF)

Vulnerability from osv_rustsec – Published: 2026-02-04 12:00 – Updated: 2026-03-24 08:16 – Source website

Summary

Missing Check for All-Zero X25519 Shared Secret

Details

Computing an X25519 shared secret with x25519_dalek::StaticSecret::diffie_hellman does not include the check that the key exchange was contributory, i.e. does not ensure on its own that the resulting shared secret is non-zero.

Impact

RFC 9180 mandates that implementations of HPKE must check for all zero Diffie-Hellman shared secrets and abort if so.

Applications using hpke-rs with the RustCryto provider would not perform this check allowing for non-contributive Diffie-Hellman shared secrets. Applications using hpke-rs with the libcrux provider are not affected.

Mitigation

Starting with version 0.6.0, an error will be returned when the computed Diffie-Hellman shared secret is all-zero.

References

URL

Type

	https://crates.io/crates/hpke-rs-rust-crypto	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0072.html	ADVISORY
	https://github.com/cryspen/hpke-rs/pull/124	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "hpke_rs_rust_crypto::HpkeRustCrypto::dh"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "hpke-rs-rust-crypto",
        "purl": "pkg:cargo/hpke-rs-rust-crypto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-g433-pq76-6cmf"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Computing an X25519 shared secret with\n`x25519_dalek::StaticSecret::diffie_hellman` does not include the\ncheck that the key exchange was contributory, i.e. does not ensure on\nits own that the resulting shared secret is non-zero.\n\n## Impact\nRFC 9180 mandates that implementations of HPKE must check for all zero\nDiffie-Hellman shared secrets and abort if so.\n\nApplications using hpke-rs with the RustCryto provider would not\nperform this check allowing for non-contributive Diffie-Hellman shared\nsecrets. Applications using hpke-rs with the libcrux provider are not\naffected.\n\n## Mitigation\nStarting with version `0.6.0`, an error will be returned when\nthe computed Diffie-Hellman shared secret is all-zero.",
  "id": "RUSTSEC-2026-0072",
  "modified": "2026-03-24T08:16:07Z",
  "published": "2026-02-04T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/hpke-rs-rust-crypto"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0072.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryspen/hpke-rs/pull/124"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Missing Check for All-Zero X25519 Shared Secret"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-G433-PQ76-6CMF

hpke-rs

hpke-rs-rust-crypto

RUSTSEC-2026-0069 (GHSA-G433-PQ76-6CMF)

Impact

Mitigation

RUSTSEC-2026-0070 (GHSA-G433-PQ76-6CMF)

Impact

Mitigation

RUSTSEC-2026-0071 (GHSA-G433-PQ76-6CMF)

Impact

Mitigation

RUSTSEC-2026-0072 (GHSA-G433-PQ76-6CMF)

Impact

Mitigation

Tags

Sightings

Nomenclature

Related by attack behaviour