libcrux-aead (>=0.0.4-pre.1, <=0.0.8) potentially affected by unknown CVE via libcrux-aesgcm (>=0.0.4, <=0.0.8)

libcrux-aesgcm CARGO version =0.0.4, =0.0.4-pre.1, =0.0.8 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0210...

PT-2026-64777

Crate libcrux-aesgcm was renamed to libcrux-aes and will no longer receive new versions under the name libcrux-aesgcm, with the final released version under that name being version 0.0.8. The original functionality is now provided in crate libcrux-aes, where development continues at version 0.0.9...

libcrux-aead (>=0.0.4-pre.1, <=0.0.8) potentially affected by unknown CVE via libcrux-aesgcm (>=0.0.4, <=0.0.8)

libcrux-aesgcm CARGO version =0.0.4, =0.0.4-pre.1, =0.0.8 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0211...

PT-2026-64399

AES-GCM decryption used an implementation for checking the provided authentication tag against the recomputed authentication tag that was intended to be constant-time, but resulted in non-constant-time code generation in certain circumstances. Note that libcrux-aesgcm does not give guarantees on...

libcrux-aead (>=0.0.4-pre.1, <=0.0.8) potentially affected by unknown CVE via libcrux-aesgcm (>=0.0.4, <=0.0.8)

libcrux-aesgcm CARGO version =0.0.4, =0.0.4-pre.1, =0.0.8 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0209...

PT-2026-60830

NIST Special Publication 800-38D specifies that the bit length of the AAD shall not exceed 2^64 - 1 bits. The implementation of AES-GCM in libcrux-aesgcm neither enforced this limit for encryption nor for decryption. Impact Use of AES-GCM with AAD of length exceeding the prescribed maximum length...

libcrux-aesgcm (0.0.4-pre.1), libcrux-ml-dsa (0.0.3) +1 more potentially affected by unknown CVE via libcrux-intrinsics (>=0.0.3, <=0.0.4-pre.1)

libcrux-intrinsics CARGO version =0.0.3, =0.0.3-alpha.2, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-2CGV-28VR-RV6J...

libcrux-aesgcm (0.0.4-pre.1) potentially affected by unknown CVE via libcrux-intrinsics (0.0.4-pre.1)

libcrux-intrinsics CARGO version 0.0.4-pre.1 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-intrinsics and may be impacted: - libcrux-aesgcm 0.0.4-pre.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0133...