AIKIDO-2026-10447
aws-lc-rs is vulnerable to Inadequate Encryption Strength
59
Medium Risk
This Affects:
aws-lc-rsTL;DR
PublicEncryptingKey::from_der wrapped decoded RSA public keys with Self(...) and skipped Self::new(), so the existing minimum key-size enforcement (2048 bits, aligned with PrivateDecryptingKey::from_pkcs8) did not run on that path. That allowed undersized public keys (for example 1024-bit) to be loaded for encryption while the private-key entry points already rejected them. The fix routes from_der through Self::new() so undersized keys return KeyRejected consistently.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
aws-lc-rs is vulnerable to Inadequate Encryption Strength in versions 1.7.0 - 1.16.1.
How to fix this
Upgrade the aws-lc-rs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant