CVE-2026-6092: Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured
Published Jun 25, 2026
·Updated
When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.
Affected Software
2 affected components
OpenSSL >=<
wolfSSL wolfssl>=5.2.0<5.9.2
Event History
Jun 25, 2026
CVE Published
via MITRE·09:06 PM
Data Sourced
via MITRE·09:06 PM
DescriptionWeakness
Data Sourced
via NVD·10:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-6092?
The severity of CVE-2026-6092 is rated as low with a CVSS score of 4.0.
2
What software is affected by CVE-2026-6092?
CVE-2026-6092 affects OpenSSL and wolfSSL.
3
How do I fix CVE-2026-6092?
To resolve CVE-2026-6092, ensure that the configurations enforce Encrypt-then-MAC instead of allowing fallback.
4
What potential risk does CVE-2026-6092 pose?
CVE-2026-6092 poses a risk of falling back to MAC-then-Encrypt, which may compromise message integrity.
5
When was CVE-2026-6092 published?
CVE-2026-6092 was published on June 25, 2026.