Executive brief
A vulnerability in the OpenSSL cryptographic library could allow sensitive data to be exposed or tampered with. When specific hardware-accelerated encryption methods are used, the last few bytes of a message may remain unencrypted and unprotected. This issue primarily affects custom applications that interact directly with low-level encryption functions rather than standard web traffic or general-purpose software.
Technical details
A vulnerability exists in the OpenSSL low-level OCB (Offset Codebook) implementation when hardware acceleration (such as AES-NI or ARMv8 CE) is active. The CRYPTO_ocb128_encrypt and CRYPTO_ocb128_decrypt functions fail to advance input/output pointers after processing full 16-byte blocks in the fast path. Consequently, the subsequent tail-handling code reprocesses the beginning of the buffer instead of the actual trailing 1-15 bytes, leaving them in cleartext and excluded from the authentication tag. This affects applications calling these low-level functions directly with non-block-aligned lengths; higher-level EVP interfaces and TLS implementations are not impacted.
Affected products
- OpenSSL Foundation OpenSSL 1.1.1, 3.0, 3.3, 3.4, 3.5, 3.6
Timeline
- 2026-01-27: advisory: Vendor advisory published by OpenSSL Foundation
- 2026-01-26: patched: Fixes committed to OpenSSL repository
References
- https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc
- https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8
- https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347
- https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae
- https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977
- https://openssl-library.org/news/secadv/20260127.txt
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html