Executive brief
OpenSSL is a widely used security library that provides encryption for internet communications and applications. A flaw in how it handles a specific encryption mode (AES-OCB) means that certain applications might reuse security numbers that are supposed to be unique for every message. This could allow an attacker to read private data or forge messages, though standard web traffic (HTTPS/TLS) is not affected.
Technical details
A vulnerability exists in OpenSSL's AES-OCB implementation when driven via the EVP_Cipher() one-shot API. The one-shot handler fails to flush the application-supplied Initialization Vector (IV) into the OCB context, causing the cipher to use an all-zero key-derived offset state for every operation. This results in (key, nonce) reuse, which compromises confidentiality. Furthermore, if EVP_EncryptFinal_ex() is used to retrieve the authentication tag, the deferred IV setup clears the running checksum, resulting in a tag that depends only on the (key, IV) pair and allows for universal forgery of ciphertext. The streaming API (EVP_CipherUpdate/Final) and the SSL/TLS implementation are unaffected.
Affected products
- OpenSSL Software Foundation OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://github.com/openssl/security/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
- https://github.com/openssl/security/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
- https://github.com/openssl/security/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
- https://github.com/openssl/security/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
- https://github.com/openssl/security/commit/983d54b5cce8d16147548ed1a37892d1720bbab6
- https://openssl-library.org/news/secadv/20260609.txt