Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-6458
PUBLISHED
More InfoOfficial Page
Assigner-Caliptra
Assigner Org ID-b01ddd03-5ef6-483b-b2c5-acba77f1a554
View Known Exploited Vulnerability (KEV) details
Published At-23 Jun, 2026 | 23:49
Updated At-24 Jun, 2026 | 13:15
Rejected At-
▼CVE Numbering Authority (CNA)
AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change. This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

Affected Products
Vendor
Caliptra
Product
Core Runtime Firmware
Collection URL
https://github.com/chipsalliance/caliptra-sw
Package Name
Core Runtime Firmware
Modules
  • aes_256_gcm_update
Default Status
unaffected
Versions
Affected
  • From 2.0.0 through 2.0.1 (semver)
  • 2.1.0 (semver)
Unaffected
  • 2.0.2 (semver)
  • 2.1.1 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-325CWE-325 Missing Cryptographic Step
Type: CWE
CWE ID: CWE-325
Description: CWE-325 Missing Cryptographic Step
Metrics
VersionBase scoreBase severityVector
4.05.1MEDIUM
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Version: 4.0
Base score: 5.1
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-148CAPEC-148 Content Spoofing
CAPEC ID: CAPEC-148
Description: CAPEC-148 Content Spoofing
Solutions
Configurations
Workarounds
Exploits
Credits
finder
NVIDIA Offensive Security Research (OSR) team
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-834g-h5x6-2hqr
N/A
Hyperlink: https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-834g-h5x6-2hqr
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found