CVE-2026-75803
Description
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validatio…
Description from NVD (National Vulnerability Database).
- Product
- OpenSSL
- Severity
- CVSS 9.1 · CRITICAL
- Published
- Source
- NVD (National Vulnerability Database) · View on NVD
Severity is the CVSS score; the real impact depends on the version and configuration you run. Always check affected versions and fixes in the original advisory.