---
id: RUSTSEC-2026-0209
title: AES-GCM did not enforce limits on AAD length
summary: AES-GCM did not enforce limits on AAD length
severity: none
vendor: libcrux-aesgcm
product: libcrux-aesgcm
ecosystem: rust
affected:
  - libcrux-aesgcm >= 0.0.0-0
published: '2026-06-09'
updated: '2026-07-17'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0209'
references:
  - url: 'https://crates.io/crates/libcrux-aesgcm'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0209.html'
  - url: 'https://github.com/celabshq/libcrux/pull/1474'
tags:
  - osv
  - rust
ingestedAt: '2026-07-17T19:00:52.087Z'
---

## Overview

NIST Special Publication 800-38D specifies that the bit length of the
AAD shall not exceed `2^64 - 1` bits. The implementation of AES-GCM in
`libcrux-aesgcm` neither enforced this limit for encryption nor for
decryption.

## Impact
Use of AES-GCM with AAD of length exceeding the prescribed maximum
length degrades the authentication security of the GCM tag.

## Mitigation
Starting from version `0.0.9` (published as `libcrux-aes@v0.0.9`),
limits on the length of the AAD input are enforced, so overlong AAD
inputs result in an error on encryption and decryption.

## Affected packages

- `libcrux-aesgcm >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.