CVE-2026-75803: OpenSSL AEAD Tag Validation Vulnerability

CVE-2026-75803 Overview

CVE-2026-75803 is an integrity check bypass in OpenSSL's Authenticated Encryption with Associated Data (AEAD) implementations for ChaCha20-Poly1305 and AES-OCB. When an application calls EVP_Cipher() on an empty ciphertext to finalize a decryption operation, OpenSSL skips the AEAD tag verification and returns success. Callers relying on this return value to confirm message authenticity may accept forged messages as valid. The flaw is classified under CWE-354: Improper Validation of Integrity Check Value. The FIPS modules in OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected because AES-OCB and ChaCha20-Poly1305 are not FIPS-approved algorithms.

Critical Impact
Applications trusting EVP_Cipher() return codes for empty-ciphertext AEAD decryption can be tricked into accepting forged messages, breaking authentication guarantees of the affected ciphers.

Affected Products

OpenSSL implementations exposing EVP_Cipher() with ChaCha20-Poly1305
OpenSSL implementations exposing EVP_Cipher() with AES-OCB
Downstream applications and libraries linking against affected OpenSSL versions

Discovery Timeline

2026-08-25 - OpenSSL publishes security advisory
2026-08-25 - CVE-2026-75803 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75803

Vulnerability Analysis

The EVP_Cipher() API is documented to behave as a one-shot AEAD encrypt/decrypt call that also verifies the authentication tag on decryption. For AES-OCB and ChaCha20-Poly1305, the provider implementations skipped the finalize path when the input length was zero. As a result, the tag comparison never executed and the function returned success. An application that decrypts an empty ciphertext and checks only the EVP_Cipher() return code will treat unauthenticated data as authenticated. This defeats the core security property of an AEAD cipher: integrity of both the ciphertext and any associated data.

Root Cause

The defect lives in the provider cipher implementations, specifically cipher_aes_ocb.c and cipher_chacha20_poly1305.c. These implementations only entered the finalize routine (which generates or checks the tag) when input data was supplied. A NULL or empty input, which OpenSSL uses to signal finalization, exited the code path before reaching the tag check. The AES-GCM-SIV provider exhibited a related defect where empty-message finalize did not reliably invoke tag generation or verification.

Attack Vector

An attacker who can influence ciphertext delivery to a vulnerable application, for example over a network protocol built on OpenSSL AEAD primitives, can submit a forged empty-ciphertext message with an arbitrary tag. The receiving application calling EVP_Cipher() for one-shot decryption observes a success return and processes any associated data as authentic. The exploit does not require key material and depends only on the caller trusting the EVP_Cipher() success indication for tag validation.

// Patch: providers/implementations/ciphers/cipher_aes_ocb.c
// Source: https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a
    if (!ossl_prov_is_running())
        return 0;

+    /*
+     * EVP_Cipher() MUST CHECK THE TAG
+     * in == NULL indicates finalize, so hand it to the finalize path
+     * (which checks the tag on decrypt / produces it on encrypt)
+     */
+    if (in == NULL)
+        return aes_ocb_block_final(vctx, out, outl, outsize);
+
    if (outsize < inl) {
        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
        return 0;

The fix routes a NULL input to aes_ocb_block_final(), which performs tag generation on encrypt and tag verification on decrypt. An equivalent change was applied to the ChaCha20-Poly1305 provider (commit 119ab95) and to AES-GCM-SIV (commit 3621257).

Detection Methods for CVE-2026-75803

Indicators of Compromise

Application logs showing successful decryption of zero-length ciphertext messages followed by unexpected state transitions or protocol errors
Unusual acceptance of empty-payload frames by services using OpenSSL ChaCha20-Poly1305 or AES-OCB
Repeated inbound messages with valid framing but zero-length ciphertext and random tag values

Detection Strategies

Inventory processes and containers that link against affected OpenSSL versions and call EVP_Cipher() for AEAD decryption
Perform source-level review for callers of EVP_Cipher() that pass zero-length input and rely on the return code for tag validation
Run negative test cases against services: submit an empty ciphertext with an invalid tag and confirm the decryption path rejects it

Monitoring Recommendations

Track OpenSSL library versions across the fleet and alert on hosts still running pre-patch builds
Log AEAD decryption outcomes at the application layer and flag empty-ciphertext successes for review
Monitor egress and ingress protocol telemetry for anomalous empty-payload authenticated frames

How to Mitigate CVE-2026-75803

Immediate Actions Required

Update OpenSSL to a fixed release as identified in the OpenSSL Security Advisory
Rebuild and redeploy statically linked applications that embed the vulnerable OpenSSL provider code
Audit application code for EVP_Cipher() callers using ChaCha20-Poly1305 or AES-OCB and add explicit tag verification via EVP_CIPHER_CTX_ctrl() where feasible

Patch Information

The fix is delivered across multiple upstream commits in the OpenSSL repository. Key references include commit 119ab95, commit 3621257, commit 6c7aa6f8, commit bdeb0cd9, and commit bf95f5f7. Consult the OpenSSL Security Advisory for exact fixed version numbers and backports.

Workarounds

Replace one-shot EVP_Cipher() calls with the EVP_EncryptUpdate/EVP_EncryptFinal_ex and EVP_DecryptUpdate/EVP_DecryptFinal_ex sequences, which return an explicit failure on tag mismatch
Where policy allows, switch AEAD cipher selection to AES-GCM until the OpenSSL update is deployed
Reject zero-length ciphertext messages at the protocol layer if empty payloads are not a legitimate application state

bash

# Verify installed OpenSSL version after patching
openssl version -a

# On Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade openssl libssl3

# On RHEL/CentOS/Fedora
sudo dnf update openssl openssl-libs

# Identify processes still using the pre-patch library
sudo lsof | grep -E 'libcrypto|libssl' | awk '{print $1,$2,$9}' | sort -u