ALPINE-CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.
ALPINE-CVE-2026-71225
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-71225
libkcapi
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.5.1-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
libkcapi
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.5.1-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
libkcapi
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.5.1-r0
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
libkcapi
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.5.1-r0
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "1.5.1-r0"
}
]
}
],
"package": {
"name": "libkcapi",
"purl": "pkg:apk/alpine/libkcapi?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-71225.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "1.5.1-r0"
}
]
}
],
"package": {
"name": "libkcapi",
"purl": "pkg:apk/alpine/libkcapi?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-71225.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "1.5.1-r0"
}
]
}
],
"package": {
"name": "libkcapi",
"purl": "pkg:apk/alpine/libkcapi?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-71225.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "1.5.1-r0"
}
]
}
],
"package": {
"name": "libkcapi",
"purl": "pkg:apk/alpine/libkcapi?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-71225.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55151 · Revision 1
- Added to Heist Feed
- Publisher date