GHSA-g433-pq76-6cmf json
Bug fixes in hpke-rs, hpke-rs-rust-crypto
published 9mo ago modified 7mo ago also RUSTSEC-2026-0069 , RUSTSEC-2026-0070 , RUSTSEC-2026-0071 , RUSTSEC-2026-0072
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:
## hpke-rs - [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom<u16>` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`. - [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64. - [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)
The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski.
## hpke-rs-rust-crypto - [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys
The issue fixed in #124 was first reported by Nadim Kobeissi.
Patch / fix
- crates.io hpke-rs 0.6.0
- crates.io hpke-rs-rust-crypto 0.6.0
- github.com/cryspen/hpke-rs@1c247b5 commit
- github.com/cryspen/hpke-rs@25248bd commit
- github.com/cryspen/hpke-rs@3a82549 commit
- github.com/cryspen/hpke-rs@b54c8bb commit
- github.com/cryspen/hpke-rs#123 pull request
- github.com/cryspen/hpke-rs#124 pull request
- github.com/cryspen/hpke-rs#127 pull request
- github.com/cryspen/hpke-rs#128 pull request
Is GHSA-g433-pq76-6cmf in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | hpke-rs | <0.6.0 >=0.0.0-0, <0.6.0 |
0.6.0 |
| crates.io | hpke-rs-rust-crypto | <0.6.0 >=0.0.0-0, <0.6.0 |
0.6.0 |
Classification
References
-
github.com
/cryspen/hpke-rs/pull/123
web
-
github.com
/cryspen/hpke-rs/pull/124
web
-
github.com
/cryspen/hpke-rs/pull/127
web
-
github.com
/cryspen/hpke-rs/pull/128
web
-
github.com
/cryspen/hpke-rs/commit/1c247b5c9aeca602ad2971c9bd49817fe2c308e6
web
-
github.com
/cryspen/hpke-rs/commit/25248bd624cc0325c98a05c169a0c9aa0aced632
web
-
github.com
/cryspen/hpke-rs/commit/3a8254938f43bdc4e0c9c4f987f8071f19779066
web
-
github.com
/cryspen/hpke-rs/commit/b54c8bb83906331bdf4f606cafa30cd7fd20b531
web
-
github.com
/cryspen/hpke-rs/security/advisories/GHSA-g433-pq76-6cmf
web
-
github.com
/cryspen/hpke-rs
package
-
rustsec.org
/advisories/RUSTSEC-2026-0070.html
web, advisory
-
rustsec.org
/advisories/RUSTSEC-2026-0072.html
web, advisory
-
crates.io
/crates/hpke-rs
package
-
rustsec.org
/advisories/RUSTSEC-2026-0069.html
advisory
-
crates.io
/crates/hpke-rs-rust-crypto
package
-
rustsec.org
/advisories/RUSTSEC-2026-0071.html
advisory
Sources
- GitHub Advisory GHSA-g433-pq76-6cmf
- OSV RUSTSEC-2026-0069
- OSV RUSTSEC-2026-0072
- OSV RUSTSEC-2026-0071
- OSV RUSTSEC-2026-0070
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.