CVE-2026-75803 in OpenSSL 3.6.2

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a

Severity

Critical 9.1

Exploitation

0% chance of exploit
in the next 30 days

Fix

Update to 3.6.4, 4.0.2

Where

Workstation tool

How it matched

Exact version match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-75803