CVE-2026-75803: AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher() function.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they decrypt empty ciphertexts with ChaCha20-Poly1305 or AES-OCB through EVP_Cipher() and treat a successful return as proof that the supplied AEAD authentication tag was validated.
What must an attacker be able to provide to exploit it?
An attacker must be able to supply a forged message with an empty ciphertext and authentication tag to an affected application path. The application must use EVP_Cipher() to finalize decryption and accept its successful result.
Are FIPS module deployments affected?
No. The OpenSSL FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected because ChaCha20-Poly1305 and AES-OCB are not FIPS-approved and are not implemented in those modules.
How can I identify potentially affected code?
Review decryption paths for EVP_Cipher() calls using ChaCha20-Poly1305 or AES-OCB. Prioritize paths where zero-length ciphertext is valid or can be attacker-controlled, and where the return value is used to accept the message.