Nonce Length Validation Issue in AesGcmCryptor of Go Standard Library

CVE-2026-89312

What is CVE-2026-89312?

A vulnerability exists in the AesGcmCryptor component of the Go standard library, where the system inadequately assesses the length of the nonce provided by callers. This oversight allows a nonce of incorrect length to be passed directly to the cipher.AEAD.Open function. When the nonce does not conform to the required size, it results in a panic, crashing the decrypting goroutine instead of gracefully handling the error. This flaw has implications for the reliability and security of applications relying on this library for encryption, making it crucial to adopt appropriate measures to manage nonce sizes effectively.

References