Rust advisories / libcrux-aesgcm
VulnerabilityRUSTSEC-2026-0209 · libcrux-aesgcm
RUSTSEC-2026-0209: AES-GCM did not enforce limits on AAD length
Short answerA security vulnerability in the libcrux-aesgcm crate: AES-GCM did not enforce limits on AAD length. No severity score was published. No fixed version: replace the crate or remove the affected code path.
| Crate | libcrux-aesgcm |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| Published | 2026-06-09 |
| Last changed | 2026-07-17 |
| Also known as | none |
| Affected functions | libcrux_aesgcm::AesGcm128Key::decrypt, libcrux_aesgcm::AesGcm128Key::encrypt, libcrux_aesgcm::AesGcm256Key::decrypt, libcrux_aesgcm::AesGcm256Key::encrypt, libcrux_aesgcm::aes_gcm_128::AesGcm128::decrypt, libcrux_aesgcm::aes_gcm_128::AesGcm128::encrypt, libcrux_aesgcm::aes_gcm_128::Key::decrypt, libcrux_aesgcm::aes_gcm_128::Key::encrypt, libcrux_aesgcm::aes_gcm_128::KeyRef::decrypt, libcrux_aesgcm::aes_gcm_128::KeyRef::encrypt, libcrux_aesgcm::aes_gcm_128::neon::Key::decrypt, libcrux_aesgcm::aes_gcm_128::neon::Key::encrypt |
What to do
- Find who pulls it in:
cargo tree -i libcrux-aesgcm. - Avoid the affected API (
libcrux_aesgcm::AesGcm128Key::decrypt,libcrux_aesgcm::AesGcm128Key::encrypt,libcrux_aesgcm::AesGcm256Key::decrypt,libcrux_aesgcm::AesGcm256Key::encrypt,libcrux_aesgcm::aes_gcm_128::AesGcm128::decrypt,libcrux_aesgcm::aes_gcm_128::AesGcm128::encrypt), or replace the crate.
Details from the advisory
NIST Special Publication 800-38D specifies that the bit length of the AAD shall not exceed 2^64 - 1 bits. The implementation of AES-GCM in libcrux-aesgcm neither enforced this limit for encryption nor for decryption.
Impact
Use of AES-GCM with AAD of length exceeding the prescribed maximum length degrades the authentication security of the GCM tag.
Mitigation
Starting from version 0.0.9 (published as libcrux-aes@v0.0.9), limits on the length of the AAD input are enforced, so overlong AAD inputs result in an error on encryption and decryption.
References
- Package: crates.io/crates/libcrux-aesgcm
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0209.html
- Web: github.com/celabshq/libcrux/pull/1474
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for libcrux-aesgcm
Up next
Same cratelibcrux-aesgcm: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?