{"id":"CVE-2026-75803","state":"PUBLISHED","title":"AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.","publishedAt":"2026-08-25T13:00:25.067Z","updatedAt":"2026-09-01T18:23:06.793Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"CISA-ADP"},"assigner":"openssl","products":["OpenSSL OpenSSL"],"affected":[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","status":"affected","lessThan":"4.0.2","versionType":"semver"},{"version":"3.6.0","status":"affected","lessThan":"3.6.4","versionType":"semver"},{"version":"3.5.0","status":"affected","lessThan":"3.5.8","versionType":"semver"},{"version":"3.4.0","status":"affected","lessThan":"3.4.7","versionType":"semver"},{"version":"3.0.0","status":"affected","lessThan":"3.0.22","versionType":"semver"}]}],"references":["https://openssl-library.org/news/secadv/20260825.txt","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42"],"weaknesses":["CWE-354"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/75xxx/CVE-2026-75803.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-75803","state":"PUBLISHED","datePublished":"2026-08-25T13:00:25.067Z","dateUpdated":"2026-09-01T18:23:06.793Z","assignerShortName":"openssl","assignerOrgId":"3a12439a-ef3a-4c79-92e6-6081a721f1e5","dateReserved":"2026-08-18T09:34:32.659Z"},"containers":{"cna":{"title":"AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()","descriptions":[{"lang":"en","value":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}],"affected":[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","status":"affected","lessThan":"4.0.2","versionType":"semver"},{"version":"3.6.0","status":"affected","lessThan":"3.6.4","versionType":"semver"},{"version":"3.5.0","status":"affected","lessThan":"3.5.8","versionType":"semver"},{"version":"3.4.0","status":"affected","lessThan":"3.4.7","versionType":"semver"},{"version":"3.0.0","status":"affected","lessThan":"3.0.22","versionType":"semver"}]}],"references":[{"url":"https://openssl-library.org/news/secadv/20260825.txt","name":"OpenSSL Advisory","tags":["vendor-advisory"]},{"url":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","name":"4.0.2 git commit","tags":["patch"]},{"url":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","name":"3.6.4 git commit","tags":["patch"]},{"url":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","name":"3.5.8 git commit","tags":["patch"]},{"url":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","name":"3.4.7 git commit","tags":["patch"]},{"url":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","name":"3.0.22 git commit","tags":["patch"]}],"metrics":[{"format":"other","other":{"content":{"text":"Low"},"type":"https://openssl-library.org/policies/general/security-policy/"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-354","description":"Improper Validation of Integrity Check Value","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"openssl","orgId":"3a12439a-ef3a-4c79-92e6-6081a721f1e5","dateUpdated":"2026-08-25T13:00:25.067Z"},"credits":[{"lang":"en","type":"reporter","value":"Billy Brumley (Rochester Institute of Technology)"},{"lang":"en","type":"remediation developer","value":"Billy Brumley (Rochester Institute of Technology)"}],"datePublic":"2026-08-25T15:57:42.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-01T18:22:51.167833Z","id":"CVE-2026-75803","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-01T18:23:06.793Z"}}]}}}