Common Weakness Enumeration

CWE-323 Reusing a Nonce, Key Pair in Encryption

Description

Nonces should be used for the present occasion and only once.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-323 ordered by modification date.

11 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-574f-3g2m-x479	CVE-2025-14813	CRITICAL	maven/org.bouncycastle/bcprov-debug-jdk14 maven/org.bouncycastle/bcprov-debug-jdk15on maven/org.bouncycastle/bcprov-debug-jdk15to18 maven/org.bouncycastle/bcprov-debug-jdk18on maven/org.bouncycastle/bcprov-ext-debug-jdk14 maven/org.bouncycastle/bcprov-ext-debug-jdk15to18 maven/org.bouncycastle/bcprov-ext-debug-jdk18on maven/org.bouncycastle/bcprov-ext-jdk14 maven/org.bouncycastle/bcprov-ext-jdk15to18 maven/org.bouncycastle/bcprov-ext-jdk18on maven/org.bouncycastle/bcprov-jdk14 maven/org.bouncycastle/bcprov-jdk15on maven/org.bouncycastle/bcprov-jdk15to18 maven/org.bouncycastle/bcprov-jdk18on	Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks	2026-09-24
GHSA-qv2q-c278-pch5	-	LOW	nuget/Magick.NET-Q16-AnyCPU nuget/Magick.NET-Q16-HDRI-AnyCPU nuget/Magick.NET-Q16-HDRI-OpenMP-arm64 nuget/Magick.NET-Q16-HDRI-arm64 nuget/Magick.NET-Q16-HDRI-x64 nuget/Magick.NET-Q16-HDRI-x86 nuget/Magick.NET-Q16-OpenMP-arm64 nuget/Magick.NET-Q16-OpenMP-x64 nuget/Magick.NET-Q16-arm64 nuget/Magick.NET-Q16-x64 nuget/Magick.NET-Q16-x86 nuget/Magick.NET-Q8-AnyCPU nuget/Magick.NET-Q8-OpenMP-arm64 nuget/Magick.NET-Q8-OpenMP-x64 nuget/Magick.NET-Q8-arm64 nuget/Magick.NET-Q8-x64 nuget/Magick.NET-Q8-x86	ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse	2026-05-21
GHSA-xr5h-phrj-8vxv	CVE-2026-45028	LOW	npm/astro	Astro: Server island encrypted parameters vulnerable to cross-component replay	2026-05-14
GHSA-r2jw-c95q-rj29	-	MODERATE	-	Duplicate Advisory: cocoon Reuses a Nonce, Key Pair in Encryption	2025-12-29
GHSA-w3hj-wr2q-x83g	CVE-2024-23688	LOW	maven/tech.pegasys.discovery/discovery	Discovery uses the same AES/GCM Nonce throughout the session	2025-12-02
GHSA-wp4m-7hpj-8qp8	-	MODERATE	maven/tech.pegasys.discovery/discovery	Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session	2025-12-02
GHSA-73g8-5h73-26h4	CVE-2025-64767	CRITICAL	npm/@hpke/core	@hpke/core reuses AEAD nonces	2025-11-21
GHSA-258h-f687-4226	CVE-2024-41951	MODERATE	pypi/PheonixAppAPI	PheonixAppAPI has visible Encoding Maps	2024-11-12
GHSA-x72p-g37q-4xr9	CVE-2024-40430	MODERATE	golang/github.com/drakkan/sftpgo/v2	Withdrawn: SFTPGo's JWT implmentation lacks certain security measures	2024-07-31
GHSA-v84f-6r39-cpfc	CVE-2023-4680	MODERATE	golang/github.com/hashicorp/vault	HashiCorp Vault Improper Input Validation vulnerability	2023-09-15
GHSA-qp4f-2w67-c8hw	CVE-2020-2099	HIGH	maven/org.jenkins-ci.main/jenkins-core	Inbound TCP Agent Protocol/3 authentication bypass in Jenkins	2022-12-16