What is GHSA-vqxm-cgmv-2pcr?

GHSA-vqxm-cgmv-2pcr is a security advisory published by GitHub Security Advisories with Medium severity. An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM...

Which CVE IDs does GHSA-vqxm-cgmv-2pcr cover?

GHSA-vqxm-cgmv-2pcr covers the following CVE IDs: CVE-2026-87732. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqxm-cgmv-2pcr?

GHSA-vqxm-cgmv-2pcr has a CVSS v3 base score of 6.2, published by GitHub Security Advisories.

GHSA-vqxm-cgmv-2pcrMediumCVSS 6.2

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-87732 →

📋 Description

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87732
https://osv.dev/vulnerability/OSEC-2026-12
https://github.com/advisories/GHSA-vqxm-cgmv-2pcr