🛡️ GHSA-g433-pq76-6cmf — hpke-rs
Description
Bug fixes in hpke-rs, hpke-rs-rust-crypto
We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:
hpke-rs
- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix
KemAlgorithm::TryFrom<u16>mapping where0x004Dincorrectly resolved toXWingDraft06instead ofXWingDraft06Obsolete. - [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.
- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)
The issue fixed in #123 was first reported by Nadim Kobeissi.
The issues fixed in #127 and #128 were first reported by Scott Arciszewski.
hpke-rs-rust-crypto
- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys
The issue fixed in #124 was first reported by Nadim Kobeissi.
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity none, availability high.
Weakness class
GHSA-g433-pq76-6cmf is classified as CWE-190: Integer Overflow or Wraparound. Arithmetic produces a value too large for its type and wraps around, so a later size or bounds check passes when it should not.
Affected software
GHSA-g433-pq76-6cmf is recorded against 2 packages.
- hpke-rs
- hpke-rs-rust-crypto
Timeline and source
Published on 13 February 2026 and last revised on 25 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Package)
rustsec.org (Web)
rustsec.org (Web)
Details
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| hpke-rs | — | — |
| hpke-rs-rust-crypto | — | — |
References
Similar Threats
- Unknown RUSTSEC-2026-0069
- Unknown RUSTSEC-2026-0070
- Unknown RUSTSEC-2026-0071
- Unknown RUSTSEC-2026-0072
Site Security Check
Is hpke-rs part of your stack?
GHSA-g433-pq76-6cmf is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.