{"action":"Upgrade ic-cipher to 0.2.20 or later.","affected":[{"fixed":"0.2.20","introduced":"0.2.5"}],"component":"ic-cipher","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.2.20"],"ghsa_id":"GHSA-xr22-8pqp-gwfh","id":"tcs_01M5KFCEKGNKGAXA42BT7FWYPA","modified_at":"2026-10-12T18:15:01.974078373Z","published_at":"2026-10-09T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0337","https://crates.io/crates/ic-cipher","https://rustsec.org/advisories/RUSTSEC-2026-0337.html","https://github.com/nervosys/IronCrypto/commit/a8160a18b5c66288f05dc62f5ea2159c687b9416"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0337","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0337"}],"summary":"Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more"}