Formally Modeling the Terrapin Attack on SSH

The Terrapin attack against SSH channel integrity USENIX Security 2024 used a novel attack vector: attacks on the channel state. Surprisingly, not all AEAD modes of SSH were equally affected by this attack, and it remained an open question if "unaffected" meant "secure". Existing formal models fo...

CVE-2026-15890: Reusing a Nonce, Key Pair in Encryption

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

PT-2026-96272

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the PSA Internal Trusted Storage ITS transform module where the function secure storage its transform aead get nonce uses unsynchronized function-local static variables s...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

OPENSUSE-SU-2026:21864-1 Security update for mbedtls-2

This update for mbedtls-2 fixes the following issues: Changes in mbedtls-2: - CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs boo1245810 - CVE-2025-59438: padding oracle through timing of cipher error reporting boo1252454...

CVE-2026-0177

In dosssaesgcm256op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0177

In dosssaesgcm256op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.14 security and extras update

Red Hat OpenShift Container Platform release 4.22.14 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

PT-2026-92283

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing bounds check in the do sss aes gcm 256 op function within the crypto-aes.c file allows for a possible out-of-bounds read. This issue could result in...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

Astra Linux – Vulnerability in mbedtls

Mbed TLS before version 3.6.4 has a race condition in AESNI detection when certain compiler optimizations are applied. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...

Astra Linux – Vulnerability in Linux, Linux 5.10

A memory leak flaw was discovered in the Linux kernel’s ccprunaesgcmcmd function, which allows an attacker to cause a denial of service. This vulnerability is similar to the older CVE-2019-18808. The greatest threat posed by this vulnerability is to system availability...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : GnuPG vulnerability (USN-8720-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8720-1 advisory. It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GC...

MAL-2026-16095 Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

DEBIAN-CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

Module-Lattice-Based Digital Signature Algorithm Utility 20260908

This is mldsa, a module-lattice-based digital signature algorithm utility for generating keypairs, signing and verifying files and data. It has an alter ego, mlsignify, implementing the same command line switches as signify1. The mldsa and mlsignify utilities are based on the libmldsa3 library,...

PT-2026-88811

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate decrypt into and Chacha20.authenticate decrypt into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns...