CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path
AES-OCB IV Ignored on EVPCipher() Path
Other sources
Issue summary: When an application drives an AES-OCB context through the public EVPCipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u7Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-18 - Upgrade
Upgrade
OpenSSL 3.0to a version that resolves this vulnerability.Fixed in 3.0.21 - Upgrade
Upgrade
OpenSSL 3.4to a version that resolves this vulnerability.Fixed in 3.4.6 - Upgrade
Upgrade
OpenSSL 3.5to a version that resolves this vulnerability.Fixed in 3.5.7 - Upgrade
Upgrade
OpenSSL 3.6to a version that resolves this vulnerability.Fixed in 3.6.3 - Upgrade
Upgrade
OpenSSL 4.0to a version that resolves this vulnerability.Fixed in 4.0.1 - Configuration
If your application uses AES-OCB, avoid the vulnerable EVP_Cipher() one-shot interface; use the streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) so the application-supplied IV is applied synchronously during cipher initialisation and the deferred IV setup/tag calculation behavior is not triggered.
OpenSSL EVP AES-OCB usage IV handling via cipher interface = Use the documented streaming AEAD interface (EVP_CipherUpdate / EVP_CipherFinal_ex) instead of the EVP_Cipher() one-shot interface
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45445?
CVE-2026-45445 has a severity rating of high with a CVSS score of 7.5.
What is the impact of CVE-2026-45445?
CVE-2026-45445 could lead to the silent discard of the application-supplied initialization vector (IV) when using AES-OCB via the EVP_Cipher() function.
How do I fix CVE-2026-45445?
To mitigate CVE-2026-45445, ensure that your implementation of OpenSSL is updated to a version where this vulnerability is patched.
Which software is affected by CVE-2026-45445?
CVE-2026-45445 affects the OpenSSL library and potentially its implementations in Debian/openssl.
When was CVE-2026-45445 published?
CVE-2026-45445 was published on May 27, 2026.