Executive brief
OpenSSL, a widely used toolkit for secure communications, contains a flaw in how it handles specific encryption methods (AES-SIV and AES-GCM-SIV). An attacker could forge messages that appear to be authentic even if they do not possess the correct security keys. This could allow a malicious actor to bypass security checks in custom applications that rely on these specific encryption modes for data integrity.
Technical details
A vulnerability exists in OpenSSL's provider implementation of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) where the expected authentication tag is not recalculated if the decryption function is called with zero-length ciphertext. In such cases, the internal tag buffer retains an all-zeros value. An attacker can exploit this by providing arbitrary AAD and an all-zeros tag to pass authentication without knowing the key. For AES-GCM-SIV, this is a single-shot attack; for AES-SIV, it requires the application to reuse the decryption context without resetting the key. The vulnerability only affects applications using the EVP interface for these specific modes and skipping ciphertext updates for empty messages; OpenSSL's internal protocols (TLS, QUIC, etc.) are not affected.
Affected products
- OpenSSL OpenSSL 3.0, 3.2, 3.4, 3.5, 3.6, 4.0
Timeline
- 2026-06-09: advisory: OpenSSL Security Advisory published
References
- https://github.com/openssl/security/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
- https://github.com/openssl/security/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3
- https://github.com/openssl/security/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85
- https://github.com/openssl/security/commit/daca0f48e4a69a2892a62262bad59e62a8a76598
- https://github.com/openssl/security/commit/eec5e9bf0d867333b8495e456f5235d225798a68
- https://openssl-library.org/news/secadv/20260609.txt