Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-71225

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Stephan Muelle libkcapi

Default version status: unaffected

  • 0.10.1 to < 1.5.1affected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:1.5.1-1.el10_2 to < *unaffected

Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

Default version status: affected

  • 0:1.5.0-6.el10_0 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:1.4.0-3.el8_10 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:1.4.0-3.el9_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Default version status: affected

  • 0:1.4.0-2.el9_6.1 to < *unaffected

Red Hat Red Hat Hardened Images

Default version status: affected

  • 1.5.1-0.1.hum1 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

References