Vulnerability HighRUSTSEC-2026-0070 · hpke-rs
RUSTSEC-2026-0070: Panic When Opening or Sealing on Export-Only Context
Short answerA security vulnerability in the hpke-rs crate: Panic When Opening or Sealing on Export-Only Context. GitHub rates it High. Fixed in 0.6.0: update to a fixed version.
| Crate | hpke-rs |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.6.0. |
| Fixed in | 0.6.0 |
| Severity | High (GitHub rating) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| Published | 2026-02-11 |
| Last changed | 2026-03-24 |
| Also known as | GHSA-g433-pq76-6cmf, RUSTSEC-2026-0069, RUSTSEC-2026-0071, RUSTSEC-2026-0072 |
| Affected functions | hpke_rs::Context::open, hpke_rs::Context::seal |
What to do
- See which version you have:
cargo tree -i hpke-rs(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p hpke-rs. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplehpke-rs = "0.6.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Constructing an HPKE Context with the AEAD algorithm set to HpkeExport resulted in a panic when calling Context::seal, or Context::open. This was due to an underflowing integer subtraction when calculating the length of a vector allocation for the AEAD nonce, which would panic on its own in debug mode and cause out-of-memory abort on the allocation in release mode.
Impact
Applications that could be made to use an HPKE context configured with HpkeExport as AEAD algorithm to open or seal a ciphertext would crash. Other applications are unaffected.
Mitigation
Starting with version 0.6.0, an error will be returned when attempting to call Context::seal or Context::open on an HPKE context with HpkeExport as AEADAlgorithm.
References
- Package: crates.io/crates/hpke-rs
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0070.html
- Web: github.com/cryspen/hpke-rs/pull/128
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for hpke-rs
Up next
Same cratehpke-rs: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?