{"id":"RUSTSEC-2026-0238","aliases":["GHSA-h9f2-fgp8-vc4h"],"title":"Low-level GCM ignores the operation nonce","summary":"Low-level GCM ignores the operation nonce","severity":"none","vendor":"dcrypt-algorithms","product":"dcrypt-algorithms","ecosystem":"rust","affected":["dcrypt-algorithms >= 0.0.0-0, < 2.0.0"],"patched":["dcrypt-algorithms 2.0.0"],"published":"2026-08-09","updated":"2026-08-09","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0238","references":[{"url":"https://crates.io/crates/dcrypt-algorithms"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0238.html"},{"url":"https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-h9f2-fgp8-vc4h"},{"url":"https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8"},{"url":"https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0"}],"tags":["osv","rust"],"ingestedAt":"2026-08-09T19:16:06.050Z","slug":"RUSTSEC-2026-0238","body":"## Overview\n\nIn all published versions of `dcrypt-algorithms` before 2.0.0, the low-level\n`Gcm` builder required an operation nonce but derived `J0` from the nonce\ncaptured by the original `Gcm` constructor. Multiple operations could therefore\nsilently reuse a nonce even when callers supplied distinct values, compromising\nconfidentiality and authenticity under an affected key.\n\nVersion 2.0.0 makes `Gcm` key-only and passes the operation nonce through IV\nderivation, encryption, and decryption. It also corrects non-96-bit IV\nprocessing, rejects tags shorter than 96 bits, and enforces counter limits.\nApplications must upgrade, identify affected keys, rotate them, and re-encrypt\naffected data; updating the implementation cannot restore security after nonce\nreuse.\n\n## Affected packages\n\n- `dcrypt-algorithms >= 0.0.0-0, < 2.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dcrypt-algorithms 2.0.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}