{"id":"RUSTSEC-2026-0071","summary":"Nonce Reuse in HPKE Context","details":"The sequence number that is used to compute the AEAD nonce when using\na re-usable HPKE context is incremented after each seal or open\noperation. This sequence number was stored as a `u32` and used regular\naddition on `u32` for the increment, meaning in release mode it would\nsilently wrap around to 0 after 2^32 seal or open operations.\n\n## Impact\nNonce reuse causes catastrophic breakage of AEAD ciphers, enabling\nplaintext recovery attacks and authentication tag forgeries, depending\non the concrete AEAD.\n\nThis bug impacts applications that use hpke-rs to encrypt a large\nnumber of messages using the same context. Applications using the\none-shot APIs are unaffected.\n\n## Mitigation\nStarting with version `0.6.0`, `checked_add` is used to increment the\nsequence number, which avoids a silent wraparound in release\nmode. Additionally, the sequence number is now stored as a `u64`,\nincreasing the maximally allowed number of seal and open operations on\na given HPKE context.","aliases":["GHSA-g433-pq76-6cmf","RUSTSEC-2026-0069","RUSTSEC-2026-0070","RUSTSEC-2026-0072"],"modified":"2026-03-24T08:41:23.142103Z","published":"2026-02-05T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hpke-rs"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0071.html"},{"type":"WEB","url":"https://github.com/cryspen/hpke-rs/pull/123"}],"affected":[{"package":{"name":"hpke-rs","ecosystem":"crates.io","purl":"pkg:cargo/hpke-rs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["hpke_rs::Context::open","hpke_rs::Context::seal"],"os":[]}},"database_specific":{"cvss":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0071.json","categories":[]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}