RUSTSEC-2026-0238

In all published versions of dcrypt-algorithms before 2.0.0, the low-level Gcm builder required an operation nonce but derived J0 from the nonce captured by the original Gcm constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values, compromising confidentiality and authenticity under an affected key.

Version 2.0.0 makes Gcm key-only and passes the operation nonce through IV derivation, encryption, and decryption. It also corrects non-96-bit IV processing, rejects tags shorter than 96 bits, and enforces counter limits. Applications must upgrade, identify affected keys, rotate them, and re-encrypt affected data; updating the implementation cannot restore security after nonce reuse.