CVE-2026-21383

0th percentile - higher than 0% of all known CVEs

The vulnerability is caused by using a static initialization vector (IV) for AES-GCM key wrapping. AES-GCM requires a unique IV for each operation to ensure cryptographic security.

Using a static IV allows an attacker to recover the keystream and potentially decrypt or modify protected data, leading to a breach of confidentiality and integrity of cryptographic keys.

Update the cryptographic library to a version that generates a unique IV for each AES-GCM key wrapping call. As a temporary workaround, manually generate a random IV for each operation.