Use of a Broken or Risky Cryptographic Algorithm Affecting libcrux-aesgcm package, versions <0.0.9
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-LIBCRUXAESGCM-18017882
- published19 Jul 2026
- disclosed9 Jun 2026
- creditUnknown
Introduced: 9 Jun 2026
CVE NOT AVAILABLE CWE-327 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade libcrux-aesgcm to version 0.0.9 or higher.
Overview
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm in the encrypt and decrypt functions when processing Additional Authenticated Data (AAD) that exceeds the maximum allowed length as specified by NIST SP 800-38D. An attacker can degrade the authentication security of the GCM tag by supplying overlong AAD inputs.