GitHub Advisoryadvisory · crates.io

GHSA-g433-pq76-6cmf Bug fixes in hpke-rs, hpke-rs-rust-crypto

HIGH Published 2026-02-13 Modified 2026-03-25 Official page ↗
Ecosystem
crates.io
Packages
hpke-rs, hpke-rs-rust-crypto
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-190, CWE-20, CWE-697
Reviewed
2026-02-13

Affected packages

• crates.io hpke-rs: < 0.6.0 → fixed in 0.6.0 • crates.io hpke-rs-rust-crypto: < 0.6.0 → fixed in 0.6.0

Description

We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes: hpke-rs • #127: Fix `KemAlgorithm::TryFrom` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`. • #123: Fix potential overflow in context counter and switch to use u64. • #128: Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it) The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski. hpke-rs-rust-crypto • #124: Error out on x25519 0 keys The issue fixed in #124 was first reported by Nadim Kobeissi.

Related

Weakness · CWE (3)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-20 Improper Input Validation weakness
  • CWE-697 Incorrect Comparison weakness

References