Threats tagged 'ghsa-vqxm-cgmv-2pcr'

CVE-2026-87732 is a vulnerability in the mirage-crypto package for OCaml versions before 2.2.0. The AES.GCM and Chacha20 authenticate_decrypt_into functions decrypt data into a buffer before verifying the cryptographic tag. If the tag is forged, the functions return false but the buffer still contains the decrypted plaintext, potentially exposing sensitive data.