RUSTSEC-2026-0428: BLAKE2b produces wrong tag when using `reset()` with a different-length key

Q: Who is affected by this issue?

Applications using rust/orion's hazardous::mac::blake2b::Blake2b API are affected if they initialize an instance with one key length and later call reset() with a key whose length differs. The stated impact is incorrect tags and failed verification under honest protocol conditions.

Q: What conditions are required to trigger the problem?

A Blake2b instance must first be created with a key of length N, then reset() must be called using a key with a length other than N. Using reset() with the same key length is not described as affected.

Q: How can this be remediated?

Upgrade rust/orion to version 0.17.16 or 0.18.1.

Published Oct 30, 2026

Updated

Summary

hazardous::mac::blake2b::Blake2b::reset() does not correctly reset the state when a key is supplied that has a different length than the one used upon initialization with hazardous::mac::blake2b::Blake2b::new(), because it errorneously uses a cached length.

Impact

Initialization hazardous::mac::blake2b::Blake2b with a key of some length N, followed by a reset with a key of length != N will produce an incorrect BLAKE2b tag, causing hazardous::mac::blake2b::Blake2b::verify() to fail. This means under honest protocol conditions, parties could experience failing tag verifications.

Resolution

Upgrade to v0.17.16 or v0.18.1.

Affected Software

2 affected componentsFixes available

rust/orion>=0.0.0-0<0.17.16

0.17.16

rust/orion>=0.18.0-0<0.18.1

0.18.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/orion to a version that resolves this vulnerability.
Fixed in 0.17.16
Upgrade
Upgrade rust/orion to a version that resolves this vulnerability.
Fixed in 0.18.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v0.17.16
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v0.18.1

Event History

Oct 30, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

Who is affected by this issue?

Applications using rust/orion's hazardous::mac::blake2b::Blake2b API are affected if they initialize an instance with one key length and later call reset() with a key whose length differs. The stated impact is incorrect tags and failed verification under honest protocol conditions.

What conditions are required to trigger the problem?

A Blake2b instance must first be created with a key of length N, then reset() must be called using a key with a length other than N. Using reset() with the same key length is not described as affected.

How can this be remediated?

Upgrade rust/orion to version 0.17.16 or 0.18.1.

RUSTSEC-2026-0428: BLAKE2b produces wrong tag when using `reset()` with a different-length key

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is affected by this issue?

What conditions are required to trigger the problem?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is affected by this issue?

What conditions are required to trigger the problem?

How can this be remediated?