CVE-2026-88823

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88823", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-09-10T09:08:26.966Z", "datePublished": "2026-11-10T18:15:49.358Z", "dateUpdated": "2026-11-10T18:15:49.358Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.1.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}, {"lessThan": "4.0.4", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.5.10", "status": "affected", "version": "3.5.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "J\u00e9r\u00e9my Jean (ANSSI)"}, {"lang": "en", "type": "reporter", "value": "Bhargava Shastry"}, {"lang": "en", "type": "reporter", "value": "Jonathan Bateman (Rochester Institute of Technology)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "datePublic": "2026-11-10T11:05:35.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional<br>Authenticated Data (AAD) update as a reset of all the AAD supplied so far,<br>instead of leaving the AAD unchanged. An application that supplies its AAD in<br>several fragments, one of which is empty, therefore produces or verifies<br>messages whose authentication tag does not cover the AAD supplied before<br>the empty fragment.<br><br>Impact summary: Data an application intended to authenticate alongside a<br>message is silently left unauthenticated. An attacker can forge the AAD of such<br>a message.<br><br>CWE: CWE-325: Missing Cryptographic Step<br><br>Description: An application passing AAD in multiple chunks of which some have<br>zero length will have the previous AAD chunks effectively unauthenticated. Also,<br>on context re-initialisation, the AAD was not reset, which meant that any AAD<br>accumulated from the previous context usage were also included in the AAD of the<br>new message.<br><br>The fix makes a zero-length AAD update a no-op and clears any accumulated AAD<br>whenever the context is re-initialised with a key or a nonce.<br>A re-initialisation that only changes parameters keeps the AAD.<br><br>FIPS impact: no<br>The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved<br>algorithm and is implemented only in the default provider, outside the<br>OpenSSL FIPS module boundary."}], "value": "Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-325", "description": "CWE-325 Missing Cryptographic Step", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-11-10T18:15:49.358Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20261110.txt"}, {"name": "4.1.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90"}, {"name": "4.0.4 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682"}, {"name": "3.5.10 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4"}], "source": {"discovery": "UNKNOWN"}, "title": "AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.1.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}, {"lessThan": "4.0.4", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.5.10", "status": "affected", "version": "3.5.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}], "id": "CVE-2026-88823", "lastModified": "2026-11-10T22:10:04.727", "metrics": {}, "published": "2026-11-10T19:21:34.847", "references": [{"source": "openssl-security@openssl.org", "url": "https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4"}, {"source": "openssl-security@openssl.org", "url": "https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682"}, {"source": "openssl-security@openssl.org", "url": "https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90"}, {"source": "openssl-security@openssl.org", "url": "https://openssl-library.org/news/secadv/20261110.txt"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-325"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{}

{}