# orion BLAKE2b wrong tag with reset on different-length key

Source: https://junglewise.ai/threats/rustsec-2026-0428-blake2b-produces-wrong-tag-when-using-reset-with-a-28d6638f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-10-30

The orion cryptographic library's BLAKE2b message authentication code implementation fails to properly reset its internal state when switching to a different-length key. This causes message authentication verification to fail unexpectedly during normal operation, potentially disrupting services that rely on this library for cryptographic authentication.

Technologies: [orion (crates.io)](https://junglewise.ai/threats/technologies/crates-io-orion). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** orion (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.17.16,introduced=0.18.0-0,fixed=0.18.1; Orion-Rs Orion 0.12.0 before 0.17.16, 0.18.0 before 0.18.1.

**Is there a fix for This vulnerability?** Yes. orion (crates.io): upgrade to 0.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run orion (crates.io) or Orion-Rs Orion at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- orion (crates.io): upgrade to 0.18.1 or later

  ```sh
  cargo update -p orion
  ```


## Technical details

The Blake2b::reset() method in orion's hazardous::mac::blake2b module incorrectly reuses a cached key length value instead of accepting a new length parameter when reinitializing with a key of different size. This results in cryptographic state corruption. An application using BLAKE2b that initializes with a key of length N and later resets with a key of length M (where M ≠ N) will produce incorrect authentication tags that fail verification, even under legitimate use.

## Affected products

- orion-rs orion 0.12.0 before 0.17.16, 0.18.0 before 0.18.1

## Identifiers

- GHSA-xcc6-f2jq-43x6
- RUSTSEC-2026-0428

## Timeline

- 2026-10-30: disclosed

## References

- [https://crates.io/crates/orion](https://crates.io/crates/orion)
- [https://rustsec.org/advisories/RUSTSEC-2026-0428.html](https://rustsec.org/advisories/RUSTSEC-2026-0428.html)

## Related threats

- [Orion cryptographic library timing vulnerability in ML-KEM and ML-DSA](https://junglewise.ai/threats/rustsec-2026-0426-llvm-introduces-timing-vulnerable-optimizations-into-e1155e1e)
- [RUSTSEC-2018-0012 - Flaw in streaming state reset() functions can create incorrect results.](https://junglewise.ai/threats/cve-2018-20999-flaw-in-streaming-state-in-orion)