Critical GCM Nonce Reuse Vulnerability in dcrypt-algorithms Package
Summary
RUSTSEC-2026-0238: Low-level GCM ignores the operation nonce. Affects dcrypt-algorithms versions >= 0.0.0-0, < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dcrypt-algorithms package is a Rust library that provides cryptographic algorithms for secure data encryption and decryption. It is designed to facilitate the implementation of various cryptographic protocols, ensuring data confidentiality and integrity. However, a significant vulnerability has been identified in versions prior to 2.0.0, where the low-level GCM (Galois/Counter Mode) builder improperly handles operation nonces, leading to potential security breaches.
Vulnerability Detail
In all published versions of dcrypt-algorithms before 2.0.0, the low-level Gcm builder required an operation nonce but derived J0 from the nonce captured by the original Gcm constructor. This flaw allowed multiple operations to silently reuse a nonce, even when distinct values were supplied by callers. As a result, the confidentiality and authenticity of data encrypted under an affected key could be compromised. The vulnerability stems from improper nonce management, which is critical in cryptographic operations to prevent replay attacks and ensure secure encryption.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than upgrading to the patched version. It is crucial to implement the upgrade as soon as possible to ensure the security of your application.
Conclusion
The dcrypt-algorithms package has a critical vulnerability related to nonce reuse in its GCM implementation. Users are strongly advised to upgrade to version 2.0.0 or later to mitigate the risks associated with this issue. Proper key management and data re-encryption are essential steps following the upgrade to ensure the security of your application.
See every vulnerability recorded for dcrypt-algorithms →
FAQ
The nonce reuse vulnerability can lead to compromised confidentiality and authenticity of encrypted data, allowing attackers to potentially decrypt sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
After upgrading to version 2.0.0, you should identify any affected keys, rotate them, and re-encrypt any data that was encrypted using the vulnerable version.
Yes, failing to upgrade exposes your application to significant security risks, including potential data breaches and unauthorized access to sensitive information.
Version 2.0.0 makes Gcm key-only, passes the operation nonce through IV derivation, encryption, and decryption, corrects non-96-bit IV processing, rejects tags shorter than 96 bits, and enforces counter limits.
