AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure
Priority MEDIUM 58CWE-347Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertext) is exposed even if the tag is incorrect. This is because in decrypt_inplace in asconcore.rs, tag verification causes an error to be returned with the plaintext contents still in buffer. The vulnerability is fixed in 0.4.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Fixed AEADs (RustCrypto): 0.4.3ascon_aead (crates.io): 0.4.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RustCrypto | AEADs | before 0.4.3 | 0.4.3 | Patch available | CNA |
| — | ascon_aead (crates.io) | before 0.4.3 | 0.4.3 | Patch available | GHSA-r38m-44fw-h886 |
- AEADs VendorRustCrypto Affected before 0.4.3 Fixed in 0.4.3 Patch available CNA
- ascon_aead (crates.io) Vendor— Affected before 0.4.3 Fixed in 0.4.3 Patch available GHSA-r38m-44fw-h886
Remediation
- Fix · CNA AEADs (RustCrypto) Fixed in 0.4.3
- Fix · GHSA-r38m-44fw-h886 ascon_aead (crates.io) Fixed in 0.4.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27498
- 2026-10-03 Alias added: GHSA-r38m-44fw-h886
References
More RustCrypto vulnerabilities
- TI-2026-18943 RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz CVSS 4.0HIGH 8.9
- TI-2026-18227 RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE CVSS 3.1HIGH 7.5
- TI-2026-18226 RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() CVSS 3.1HIGH 7.5
- TI-2026-20049 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices CVSS 3.1MEDIUM 5.3
- TI-2023-22902 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure CVSS 3.1MEDIUM 5.5
- TI-2026-36944 RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set CVSS 4.0LOW 2.0
Sources
- CVE-2025-27498 · CVE Program
- CVE-2025-27498 · NVD
- FIRST EPSS
- GHSA-r38m-44fw-h886 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences