CVE-2026-6458

The record

Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change. This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.

Affected packages

Related vulnerabilities

• CVE-2026-25250 EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic… CWE-325
• CVE-2026-76784 Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections… CWE-325
• CVE-2026-58638 Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass… CWE-325
• CVE-2026-55144 Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform… CWE-325
• CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-325
• GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds CWE-325
• CVE-2026-9266 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's… CWE-325
• CVE-2026-45446 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452)… CWE-325