CVE-2026-75803: AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
Check the tag on EVPCipher() finalize: Poly1305 and OCB AEADs
Other sources
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher() function.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the application checks/verifies the AEAD authentication tag after calling EVP_Cipher() to finalize the decryption/encryption operation for Poly1305 and OCB AEADs; do not treat success as a validated AEAD tag result when an empty ciphertext is provided.
OpenSSL EVP_Cipher() (AEAD ciphers: Poly1305 and OCB; specifically AES-OCB and ChaCha20-Poly1305) AEAD tag verification on EVP_Cipher() finalize = Ensure the AEAD tag is checked/verified
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they decrypt empty ciphertexts with ChaCha20-Poly1305 or AES-OCB through EVP_Cipher() and treat a successful return as proof that the supplied AEAD authentication tag was validated.
What must an attacker be able to provide to exploit it?
An attacker must be able to supply a forged message with an empty ciphertext and authentication tag to an affected application path. The application must use EVP_Cipher() to finalize decryption and accept its successful result.
Are FIPS module deployments affected?
No. The OpenSSL FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected because ChaCha20-Poly1305 and AES-OCB are not FIPS-approved and are not implemented in those modules.
How can I identify potentially affected code?
Review decryption paths for EVP_Cipher() calls using ChaCha20-Poly1305 or AES-OCB. Prioritize paths where zero-length ciphertext is valid or can be attacker-controlled, and where the return value is used to accept the message.