{"id":"CVE-2026-75803","summary":"AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()","details":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.","modified":"2026-09-03T08:07:41.010767Z","published":"2026-08-25T13:00:25.067Z","related":["openSUSE-SU-2026:11623-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75803.json","cna_assigner":"openssl","cwe_ids":["CWE-354"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75803.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260825.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"introduced":"89cd17a031e022211684eb7eb41190cf1910f9fa"},{"fixed":"f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9"},{"fixed":"d3c1b1169b3569ff3069e5b399f47b2b28e03d79"},{"fixed":"f4dc4d58b48d346a8270183f89acf826d459b0ca"},{"fixed":"0c5d912057abf47505b4ad455da49fbab99b76f1"},{"fixed":"a279090b9cd6b682a5a178410765a63e619fa2d9"},{"fixed":"119ab9555dc62275bbd71f6f49529b1a44feba42"},{"fixed":"3621257986e27e540bf96a11570929a6e5a9e05b"},{"fixed":"6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a"},{"fixed":"bdeb0cd994d915342787f117ee75044f0dc36f34"},{"fixed":"bf95f5f772e9362f87b25cfa2f8cb15d984865b9"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"},{"introduced":"3.6.0"},{"fixed":"3.6.4"},{"introduced":"3.5.0"},{"fixed":"3.5.8"},{"introduced":"3.4.0"},{"fixed":"3.4.7"},{"introduced":"3.0.0"},{"fixed":"3.0.22"}]}}],"versions":["openssl-3.0.21","openssl-3.4.6","openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.0.20","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.0.19","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.0-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.0-PRE-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.0.18","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.0.17","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.0.16","openssl-3.4.1","openssl-3.4.0","openssl-3.0.15","openssl-3.0.14","openssl-3.0.13","openssl-3.0.12","openssl-3.0.11","openssl-3.0.10","openssl-3.0.9","openssl-3.0.8","openssl-3.0.7","openssl-3.0.6","openssl-3.0.5","openssl-3.0.4","openssl-3.0.3","openssl-3.0.2","openssl-3.0.1","openssl-3.0.0"],"database_specific":{"vanir_signatures_modified":"2026-09-03T08:07:41Z","vanir_signatures":[{"source":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c","function":"aes_ocb_cipher"},"deprecated":false,"digest":{"function_hash":"160121964392410215386108795452143139817","length":584},"id":"CVE-2026-75803-210d1602","signature_type":"Function","signature_version":"v1"},{"target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c","function":"aes_ocb_cipher"},"deprecated":false,"digest":{"function_hash":"160121964392410215386108795452143139817","length":584},"id":"CVE-2026-75803-2f0e6b2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9"},{"source":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c","function":"chacha20_poly1305_cipher"},"deprecated":false,"digest":{"function_hash":"4265819955365890394041639825019446350","length":483},"id":"CVE-2026-75803-3f4b8cac","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"},"deprecated":false,"digest":{"function_hash":"298286425798001268200625733850503999680","length":309},"id":"CVE-2026-75803-488109a8","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["186068955723535640196329579796808331238","93875317811202247812023768733513602492","13149773597192803194956395547468376053","111348717919267684868322598199516411334","18881863763751134105423220960107418938","267870257716959397604032764140137259854","15079352522015124736780842887654920237","53824094480987831386397733233461704285","332072788788341595813098287119037397895","45522045181552413486952233884601757462","179856038325967700820571933652896994834","161899749896360516153644506310744649970","141272222373101338828534686149857292311","146341123641022473355900028554059891944","31329264775104740203784098067936112372","13000752088092483000803373576448666318","47852380880369598601488723647963043476","265446574060790628550460149431033538953"],"threshold":0.9},"id":"CVE-2026-75803-57f0e7e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c"}},{"deprecated":false,"digest":{"line_hashes":["184211945248227943217562575758663239136","95221615782895089733843227878161524844","12991833485185845579836905217573845281","170494994592972540154450477759807569349","150069043862305590619026521951714825792","83091601086865638580569443052315663744","123910008018086823740735314563474023791","116367385204886141298448350741440666779"],"threshold":0.9},"id":"CVE-2026-75803-58b97bbe","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"}},{"digest":{"line_hashes":["184211945248227943217562575758663239136","95221615782895089733843227878161524844","12991833485185845579836905217573845281","170494994592972540154450477759807569349","150069043862305590619026521951714825792","83091601086865638580569443052315663744","123910008018086823740735314563474023791","116367385204886141298448350741440666779"],"threshold":0.9},"id":"CVE-2026-75803-6dd2a4a9","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c"},"deprecated":false,"digest":{"line_hashes":["186068955723535640196329579796808331238","93875317811202247812023768733513602492","13149773597192803194956395547468376053","111348717919267684868322598199516411334","18881863763751134105423220960107418938","267870257716959397604032764140137259854","15079352522015124736780842887654920237","53824094480987831386397733233461704285","332072788788341595813098287119037397895","45522045181552413486952233884601757462","179856038325967700820571933652896994834","161899749896360516153644506310744649970","141272222373101338828534686149857292311","146341123641022473355900028554059891944","31329264775104740203784098067936112372","13000752088092483000803373576448666318","47852380880369598601488723647963043476","265446574060790628550460149431033538953"],"threshold":0.9},"id":"CVE-2026-75803-80d16a59","signature_type":"Line"},{"id":"CVE-2026-75803-8bfd03b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","target":{"function":"chacha20_poly1305_cipher","file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c"},"deprecated":false,"digest":{"function_hash":"4265819955365890394041639825019446350","length":483}},{"target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c","function":"chacha20_poly1305_update"},"deprecated":false,"digest":{"length":300,"function_hash":"11980661345105201254993244239982999852"},"id":"CVE-2026-75803-8d33e954","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a"},{"source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c","function":"aes_ocb_cipher"},"deprecated":false,"digest":{"length":584,"function_hash":"160121964392410215386108795452143139817"},"id":"CVE-2026-75803-9caf958a","signature_type":"Function","signature_version":"v1"},{"target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c"},"deprecated":false,"digest":{"line_hashes":["289141842719598881964618402365053851788","285411748556741220541419294314623339483","8116112998892650932420242355262173637"],"threshold":0.9},"id":"CVE-2026-75803-9ddce6fd","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9"},{"deprecated":false,"digest":{"function_hash":"298286425798001268200625733850503999680","length":309},"id":"CVE-2026-75803-a38ea99d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"}},{"deprecated":false,"digest":{"line_hashes":["186068955723535640196329579796808331238","93875317811202247812023768733513602492","13149773597192803194956395547468376053","111348717919267684868322598199516411334","18881863763751134105423220960107418938","267870257716959397604032764140137259854","15079352522015124736780842887654920237","53824094480987831386397733233461704285","332072788788341595813098287119037397895","45522045181552413486952233884601757462","179856038325967700820571933652896994834","161899749896360516153644506310744649970","141272222373101338828534686149857292311","146341123641022473355900028554059891944","31329264775104740203784098067936112372","13000752088092483000803373576448666318","47852380880369598601488723647963043476","265446574060790628550460149431033538953"],"threshold":0.9},"id":"CVE-2026-75803-a79c8119","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c"}},{"digest":{"line_hashes":["289141842719598881964618402365053851788","285411748556741220541419294314623339483","8116112998892650932420242355262173637"],"threshold":0.9},"id":"CVE-2026-75803-bfe3b6e5","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["332072788788341595813098287119037397895","45522045181552413486952233884601757462","179856038325967700820571933652896994834","161899749896360516153644506310744649970","141272222373101338828534686149857292311","146341123641022473355900028554059891944","31329264775104740203784098067936112372","288370105350025177749034299877770153370","83339938143354998231187054107472153402","301671201205195209338070754473715456885"],"threshold":0.9},"id":"CVE-2026-75803-c3397539","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c"}},{"target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c","function":"chacha20_poly1305_cipher"},"deprecated":false,"digest":{"function_hash":"4265819955365890394041639825019446350","length":483},"id":"CVE-2026-75803-c8d11abe","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34"},{"target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"},"deprecated":false,"digest":{"line_hashes":["184211945248227943217562575758663239136","95221615782895089733843227878161524844","12991833485185845579836905217573845281","170494994592972540154450477759807569349","150069043862305590619026521951714825792","83091601086865638580569443052315663744","123910008018086823740735314563474023791","116367385204886141298448350741440666779"],"threshold":0.9},"id":"CVE-2026-75803-cadffc02","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a"},{"deprecated":false,"digest":{"function_hash":"160121964392410215386108795452143139817","length":584},"id":"CVE-2026-75803-d3972716","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c","function":"aes_ocb_cipher"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"},"deprecated":false,"digest":{"function_hash":"298286425798001268200625733850503999680","length":309},"id":"CVE-2026-75803-d6fa7bcb"},{"id":"CVE-2026-75803-dc8613d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"},"deprecated":false,"digest":{"function_hash":"298286425798001268200625733850503999680","length":309}},{"deprecated":false,"digest":{"line_hashes":["289141842719598881964618402365053851788","285411748556741220541419294314623339483","8116112998892650932420242355262173637"],"threshold":0.9},"id":"CVE-2026-75803-ec8fcdbe","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c"}},{"digest":{"line_hashes":["184211945248227943217562575758663239136","95221615782895089733843227878161524844","12991833485185845579836905217573845281","170494994592972540154450477759807569349","150069043862305590619026521951714825792","83091601086865638580569443052315663744","123910008018086823740735314563474023791","116367385204886141298448350741440666779"],"threshold":0.9},"id":"CVE-2026-75803-f2a4240c","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","target":{"file":"providers/implementations/ciphers/cipher_chacha20_poly1305.c","function":"chacha20_poly1305_cipher"},"deprecated":false,"digest":{"function_hash":"4265819955365890394041639825019446350","length":483},"id":"CVE-2026-75803-fa06ad40","signature_type":"Function"},{"target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c","function":"aes_ocb_cipher"},"deprecated":false,"digest":{"length":584,"function_hash":"160121964392410215386108795452143139817"},"id":"CVE-2026-75803-fac01dd1","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c"},"deprecated":false,"digest":{"line_hashes":["289141842719598881964618402365053851788","285411748556741220541419294314623339483","8116112998892650932420242355262173637"],"threshold":0.9},"id":"CVE-2026-75803-fe6d9e7e"},{"deprecated":false,"digest":{"line_hashes":["289141842719598881964618402365053851788","285411748556741220541419294314623339483","8116112998892650932420242355262173637"],"threshold":0.9},"id":"CVE-2026-75803-fea4176e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","target":{"file":"providers/implementations/ciphers/cipher_aes_ocb.c"}}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-75803.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}