Vulnerability HighRUSTSEC-2026-0071 · hpke-rs
RUSTSEC-2026-0071: Nonce Reuse in HPKE Context
Short answerA security vulnerability in the hpke-rs crate: Nonce Reuse in HPKE Context. GitHub rates it High. Fixed in 0.6.0: update to a fixed version.
| Crate | hpke-rs |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.6.0. |
| Fixed in | 0.6.0 |
| Severity | High (GitHub rating) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| Published | 2026-02-05 |
| Last changed | 2026-03-24 |
| Also known as | GHSA-g433-pq76-6cmf, RUSTSEC-2026-0069, RUSTSEC-2026-0070, RUSTSEC-2026-0072 |
| Affected functions | hpke_rs::Context::open, hpke_rs::Context::seal |
What to do
- See which version you have:
cargo tree -i hpke-rs(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p hpke-rs. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplehpke-rs = "0.6.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The sequence number that is used to compute the AEAD nonce when using a re-usable HPKE context is incremented after each seal or open operation. This sequence number was stored as a u32 and used regular addition on u32 for the increment, meaning in release mode it would silently wrap around to 0 after 2^32 seal or open operations.
Impact
Nonce reuse causes catastrophic breakage of AEAD ciphers, enabling plaintext recovery attacks and authentication tag forgeries, depending on the concrete AEAD.
This bug impacts applications that use hpke-rs to encrypt a large number of messages using the same context. Applications using the one-shot APIs are unaffected.
Mitigation
Starting with version 0.6.0, checked_add is used to increment the sequence number, which avoids a silent wraparound in release mode. Additionally, the sequence number is now stored as a u64, increasing the maximally allowed number of seal and open operations on a given HPKE context.
References
- Package: crates.io/crates/hpke-rs
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0071.html
- Web: github.com/cryspen/hpke-rs/pull/123
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for hpke-rs
Up next
Same cratehpke-rs: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?