RUSTSEC-2026-0238 Low-level GCM ignores the operation nonce
The dcrypt-algorithms library ignores operation nonces in GCM mode, allowing nonce reuse that compromises confidentiality and authenticity, requiring key rotation and data re-encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0238?
RUSTSEC-2026-0238 is a vulnerability in dcrypt-algorithms, published on 9 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In all published versions of dcrypt-algorithms before 2.0.0, the low-level
Gcm builder required an operation nonce but derived J0 from the nonce
captured by the original Gcm constructor. Multiple operations could therefore
silently reuse a nonce even when callers supplied distinct values, compromising
confidentiality and authenticity under an affected key.
Version 2.0.0 makes Gcm key-only and passes the operation nonce through IV
derivation, encryption, and decryption. It also corrects non-96-bit IV
processing, rejects tags shorter than 96 bits, and enforces counter limits.
Applications must upgrade, identify affected keys, rotate them, and re-encrypt
affected data; updating the implementation cannot restore security after nonce
reuse.
Which versions are affected by RUSTSEC-2026-0238?
1 open source package ship an affected version, including dcrypt-algorithms.
| Package | Affected | Fixed in |
|---|---|---|
dcrypt-algorithms crates.io | From 0.0.0-0 | 2.0.0 |
How do I fix RUSTSEC-2026-0238?
Upgrade dcrypt-algorithms to 2.0.0 or later.
Is RUSTSEC-2026-0238 being exploited?
There is no known exploitation of RUSTSEC-2026-0238 in the wild and no public exploit code.
Sources
Also known as GHSA-h9f2-fgp8-vc4h.