Executive brief
OpenSSL's encryption library contains a flaw in how it validates authentication tags when decrypting empty messages using ChaCha20-Poly1305 and AES-OCB ciphers. Applications that rely on OpenSSL's EVP_Cipher() function to verify message authenticity may incorrectly accept forged or tampered messages, allowing attackers to bypass cryptographic integrity checks and potentially modify encrypted data without detection.
Technical details
The vulnerability exists in OpenSSL's EVP_Cipher() API when used with AEAD (Authenticated Encryption with Associated Data) ciphers ChaCha20-Poly1305 and AES-OCB. When an empty ciphertext is passed to EVP_Cipher() for decryption, the function incorrectly returns success without verifying the supplied authentication tag, violating the expected behavior of tag validation. This occurs in the built-in provider's AEAD implementations where the code takes an early exit on empty messages and skips tag comparison. The vulnerability requires only network reachability to an application using affected OpenSSL versions; an attacker can supply a corrupted or forged authentication tag that will be accepted as valid. The fix ensures these ciphers perform tag verification even for empty-ciphertext operations, aligning behavior with the streaming decryption path.
Affected products
- OpenSSL OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0 and likely earlier
Timeline
- 2026-08-25: disclosed
- 2026-08-19: patched: Patches available via commits 119ab95 and 3621257 on GitHub