{"id":"GHSA-g433-pq76-6cmf","summary":"Bug fixes in hpke-rs, hpke-rs-rust-crypto","details":"We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:\n\n## hpke-rs\n- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom\u003cu16\u003e` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.\n- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.\n- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)\n\nThe issue fixed in #123 was first reported by Nadim Kobeissi.\nThe issues fixed in #127 and #128 were first reported by Scott Arciszewski.\n\n## hpke-rs-rust-crypto\n- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys\n\nThe issue fixed in #124 was first reported by Nadim Kobeissi.","aliases":["RUSTSEC-2026-0069","RUSTSEC-2026-0070","RUSTSEC-2026-0071","RUSTSEC-2026-0072"],"modified":"2026-03-25T21:48:54.711298Z","published":"2026-02-13T20:05:10Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-02-13T20:05:10Z","nvd_published_at":null,"cwe_ids":["CWE-190","CWE-20","CWE-697"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/security/advisories/GHSA-g433-pq76-6cmf"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/pull/123"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/pull/124"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/pull/127"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/pull/128"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/commit/1c247b5c9aeca602ad2971c9bd49817fe2c308e6"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/commit/25248bd624cc0325c98a05c169a0c9aa0aced632"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/commit/3a8254938f43bdc4e0c9c4f987f8071f19779066"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/commit/b54c8bb83906331bdf4f606cafa30cd7fd20b531"},{"type":"PACKAGE","url":"https://github.com/cryspen/hpke-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0070.html"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0072.html"}],"affected":[{"package":{"name":"hpke-rs","ecosystem":"crates.io","purl":"pkg:cargo/hpke-rs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-g433-pq76-6cmf/GHSA-g433-pq76-6cmf.json"}},{"package":{"name":"hpke-rs-rust-crypto","ecosystem":"crates.io","purl":"pkg:cargo/hpke-rs-rust-crypto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-g433-pq76-6cmf/GHSA-g433-pq76-6cmf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}