CVE-2026-6331: HMAC zero-length tag forgery in EVP_DigestVerifyFinal
HMAC zero-length tag forgery in EVPDigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated tag could pass verification. The fix requires the supplied tag length to exactly equal the MAC length and rejects a zero-length MAC, so a forged short or empty tag is no longer accepted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update OpenSSL so that the EVP_DigestVerifyFinal OpenSSL-compatibility HMAC verify path requires the supplied tag length to exactly equal the MAC length (rejects zero-length and truncated/forged tags).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6331?
CVE-2026-6331 has a severity rating of low with a CVSS score of 4.0.
How do I fix CVE-2026-6331?
To fix CVE-2026-6331, update to the latest version of OpenSSL or wolfSSL that addresses the vulnerability.
What is the nature of the vulnerability in CVE-2026-6331?
CVE-2026-6331 involves a zero-length tag forgery during HMAC verification in EVP_DigestVerifyFinal.
Which software is affected by CVE-2026-6331?
CVE-2026-6331 affects OpenSSL and wolfSSL libraries.
When was CVE-2026-6331 published?
CVE-2026-6331 was published on June 25, 2026.