🛡️ RUSTSEC-2026-0239 — dcrypt-symmetric

Streaming AEAD does not authenticate stream structure

In all published versions of dcrypt-symmetric before 2.0.0, version-1 GCM and

ChaCha20-Poly1305 streams used unauthenticated terminator, counter, and length

fields. Decryptors trusted transmitted counters, allocated from unbounded

lengths, and discarded plaintext that did not fit a caller's single read

buffer. An attacker could obtain successful truncated EOF, omit, replay, or

reorder frames within a stream, or request an allocation approaching 4 GiB.

Version 2.0.0 introduces the DCRSTRM2 format, which authenticates its version,

algorithm, random stream identifier, base nonce, strict sequence, bounded

lengths, final flag, and caller AAD. It enforces authenticated finality and

physical EOF, bounds frames to 16 KiB before allocation, retains partial-read

plaintext, and rejects legacy version-1 input. Existing version-1 ciphertext

cannot retrospectively prove completeness or ordering and must be migrated only

through an application-specific, explicitly trusted process.