Executive brief
OpenSSL is a widely used security library that provides encryption for internet communications. A vulnerability in its message handling component could allow an attacker to bypass security checks or potentially decrypt sensitive information. This occurs when the library fails to properly validate the type of encryption used in certain secure messages, allowing an attacker to trick the system into using weaker, insecure methods.
Technical details
A vulnerability exists in OpenSSL's CMS implementation where AuthEnvelopedData containers do not undergo sufficient input validation for cipher and tag length fields. An attacker can exploit this by specifying a non-AEAD cipher (such as AES-256-OFB) or reducing the AEAD tag length to a single byte. By manipulating the Object Identifier (OID) and re-emitting captured messages, an attacker can use the application as a decryption oracle or brute-force the integrity check. This allows for the bypass of integrity validation or the recovery of key-equivalent functionality for the Content-Encryption Key (CEK). The issue affects OpenSSL versions 3.0 through 4.0, but does not impact FIPS modules.
Affected products
- OpenSSL Foundation OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0
Timeline
- 2026-03-12: disclosed: Initial report by Asim Viladi Oglu Manizada
- 2026-06-09: advisory: Official OpenSSL security advisory published
- 2026-06-09: patched: Fixed in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21
References
- https://github.com/openssl/security/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
- https://github.com/openssl/security/commit/439ed7d2c0962ce964482727264668bf277c333f
- https://github.com/openssl/security/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
- https://github.com/openssl/security/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
- https://github.com/openssl/security/commit/d2ca86bcd43e4f17d899f347101766b6107676e0
- https://openssl-library.org/news/secadv/20260609.txt