CVE-2026-6458 Details
Description
Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude the first batch of processed ciphertext. Ciphertext produced by that call may be modified without the tag reflecting the change. This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.
A vulnerability exists in Caliptra Core Firmware versions 2.0.0, 2.0.1, and 2.1.0, within the aes_256_gcm_update module. The issue arises from a missing cryptographic step that leads to an incorrect GCM authentication tag. When the AES-256-GCM API is used with empty Additional Authenticated Data (AAD), the hardware GHASH accumulator state is not preserved after the initial update call. This omission causes the final authentication tag to miss the first batch of processed ciphertext, allowing undetected modification of the ciphertext produced during that call. The severity of this issue is considered moderate, as it could enable unauthorized tampering with data without detection, depending on the integrator's use case.
Users can upgrade to Caliptra Core Firmware versions 2.0.2 or 2.1.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-834g-h5x6-2hqr | Caliptra |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-325 | Missing Cryptographic Step | Caliptra |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | Caliptra |