CVE-2026-6458CWE-325

AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty

Medium · published June 23, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change.

This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00197 · 8.9th percentile
Weakness
CWE-325 · Missing Cryptographic Step
Published
2026-06-23T23:49Z
EPSS history
Timeline
  • 23 JUN 23:49Z
    AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty
    cvelistv5