Read the docs
TI-2023-22902 Aliases CVE-2023-42811GHSA-423w-p2w9-r7vq

AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Priority MEDIUM 58CWE-347Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed AEADs (RustCrypto): 0.10.3aes-gcm (crates.io): 0.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RustCryptoAEADs0.10.0 to before 0.10.30.10.3Patch availableCNA
—aes-gcm (crates.io)0.10.0 to before 0.10.30.10.3Patch availableGHSA-423w-p2w9-r7vq
  • AEADs VendorRustCrypto Affected 0.10.0 to before 0.10.3 Fixed in 0.10.3 Patch available CNA
  • aes-gcm (crates.io) Vendor— Affected 0.10.0 to before 0.10.3 Fixed in 0.10.3 Patch available GHSA-423w-p2w9-r7vq

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:aes-gcm_project:aes-gcm:*:*:*:*:*:rust:*:*0.10.0 to before 0.10.3VulnerableAes-gcm Project
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
  • cpe:2.3:a:aes-gcm_project:aes-gcm:*:*:*:*:*:rust:*:* Versions 0.10.0 to before 0.10.3 Vulnerable ·Aes-gcm Project
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA AEADs (RustCrypto) Fixed in 0.10.3
  • Fix · GHSA-423w-p2w9-r7vq aes-gcm (crates.io) Fixed in 0.10.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42811
  2. 2026-10-03 Alias added: GHSA-423w-p2w9-r7vq

References

Exploit 1

Advisory 1

Other 9

  • TI-2026-18943 RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz CVSS 4.0HIGH 8.9
  • TI-2026-18227 RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE CVSS 3.1HIGH 7.5
  • TI-2026-18226 RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() CVSS 3.1HIGH 7.5
  • TI-2026-20049 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices CVSS 3.1MEDIUM 5.3
  • TI-2025-20333 AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure CVSS 4.0MEDIUM 5.6
  • TI-2026-36944 RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set CVSS 4.0LOW 2.0
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences