CVE-2026-6458

AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty

Published Jun 23, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change.

This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

Analysis

Technical impact

A defect in the Caliptra Core Runtime Firmware’s aes_256_gcm_update module causes the GCM authentication tag to omit the first batch of ciphertext when the Additional Authenticated Data (AAD) is empty. Consequently, an attacker can alter the first block of encrypted data without the resulting tag detecting the tampering, potentially compromising data integrity.

Affected Systems

The vulnerability affects Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, but the lack of an EPSS score and absence from the CISA KEV catalog suggest a lower likelihood of widespread exploitation at this time. The likely attack vector is an attacker who can supply crafted ciphertext to the streaming AES‑256‑GCM API, such as through a compromised communication channel or a malicious firmware component. With AAD empty, the missing GHASH accumulator state permits a modification that goes unchecked by the tag.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Caliptra

Core Runtime Firmware

unaffected

Version	Status	Constraints
`2.0.0`	affected	≤ 2.0.1
`2.1.0`	affected	—
`2.0.2`	unaffected	—
`2.1.1`	unaffected	—

No data.

Vendor Product Versions

Caliptra

Core Runtime Firmware

Version	Status	Scheme	Platform
`[2.0.0,2.0.1]`	affected	semver	—
`2.1.0`	affected	semver	—
`2.0.2`	unaffected	semver	—
`2.1.1`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Caliptra Core Runtime Firmware to a version that includes the patch for this issue, if one is available.
Validate that the firmware image corresponds to a fixed release by checking the vendor’s release notes or verification hash.
If a patch is not yet available, avoid using the streaming AES‑256‑GCM API with empty AAD; provide non‑empty AAD or handle GHASH state preservation across update calls to mitigate the risk.

Generated by OpenCVE AI on June 24, 2026 at 09:17 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.197% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-834g-h5x6-2hqr

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Caliptra Caliptra core Runtime Firmware
Vendors & Products		Caliptra Caliptra core Runtime Firmware

Jun 24, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 24, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change. This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.
Title		AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty
Weaknesses		CWE-325
References		https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-834g-h5x6-2hqr
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N'}`