Authentication Flaw in OpenSSL's EVP_Cipher Function Affects Multiple Products
CVE-2026-75803
Currently unrated
What is CVE-2026-75803?
The issue arises in the EVP_Cipher() API call used for AEAD ciphers, where decryption operations for ChaCha20-Poly1305 and AES-OCB may falsely report success when processing empty ciphertext. These calls do not properly verify the AEAD tag in such cases, potentially leading applications to accept forged messages incorrectly. Developers relying on this function must be cautious, as a positive return from EVP_Cipher() does not guarantee a valid AEAD tag when provided with empty input, creating a risk of message integrity being compromised.
Affected Version(s)
OpenSSL 4.0.0 < 4.0.2
OpenSSL 3.6.0 < 3.6.4
OpenSSL 3.5.0 < 3.5.8