Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-09T00:00:00 openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-347

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.

A flaw was found in OpenSSL. The implementations of AES-SIV (Advanced Encryption Standard - SIV) and AES-GCM-SIV (Advanced Encryption Standard - Galois/Counter Mode - SIV) incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages with arbitrary Additional Authenticated Data (AAD) in applications that utilize these specific cipher modes within custom protocols and do not properly handle zero-length ciphertexts. This could lead to unauthorized data manipulation.

This flaw is rated as Low impact. It affects applications that utilize OpenSSL's AES-SIV or AES-GCM-SIV modes within custom protocols and specifically mishandle empty ciphertexts. Standard OpenSSL protocols, such as TLS, are not affected. Successful exploitation requires an application to use the EVP interface and to skip ciphertext updates when processing zero-length ciphertexts, representing an uncommon and non-default configuration. The vulnerability arises from specific application implementations using OpenSSL's AES-SIV or AES-GCM-SIV modes with custom protocols and an atypical handling of empty ciphertexts. As this scenario is not a default or commonly deployed configuration in Red Hat products, and no direct configuration or operational control exists to mitigate this specific flaw without patching, the following applies: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 2026-06-11T00:00:00Z RHSA-2026:25237 openssl-1:3.5.5-4.el10_2 Red Hat Enterprise Linux 9 2026-06-11T00:00:00Z RHSA-2026:25239 openssl-1:3.5.5-4.el9_8 Red Hat Enterprise Linux 9 2026-06-11T00:00:00Z RHSA-2026:25239 openssl-1:3.5.5-4.el9_8 Red Hat Discovery 2 2026-06-24T00:00:00Z RHSA-2026:29197 discovery/discovery-server-rhel9:1782159791 Red Hat Discovery 2 2026-06-24T00:00:00Z RHSA-2026:29197 discovery/discovery-ui-rhel9:1782166952 Red Hat Insights proxy 1.5 2026-07-01T00:00:00Z RHSA-2026:34102 insights-proxy/insights-proxy-container-rhel9:1782890503 Red Hat Update Infrastructure 5 2026-06-16T00:00:00Z RHSA-2026:26319 rhui5/cds-rhel9:1781525684 Red Hat Update Infrastructure 5 2026-06-16T00:00:00Z RHSA-2026:26319 rhui5/haproxy-rhel9:1781525671 Red Hat Update Infrastructure 5 2026-06-16T00:00:00Z RHSA-2026:26319 rhui5/installer-rhel9:1781525693 Red Hat Update Infrastructure 5 2026-06-16T00:00:00Z RHSA-2026:26319 rhui5/rhua-rhel9:1781525739 Red Hat Enterprise Linux 10 Fix deferred edk2 Red Hat Enterprise Linux 10 Fix deferred shim Red Hat Enterprise Linux 10 Fix deferred shim-unsigned-aarch64 Red Hat Enterprise Linux 10 Fix deferred shim-unsigned-x64 Red Hat Enterprise Linux 6 Not affected openssl Red Hat Enterprise Linux 7 Not affected ovmf Red Hat Enterprise Linux 8 Not affected compat-openssl10 Red Hat Enterprise Linux 8 Not affected edk2 Red Hat Enterprise Linux 8 Not affected mingw-openssl Red Hat Enterprise Linux 8 Not affected openssl Red Hat Enterprise Linux 8 Not affected shim Red Hat Enterprise Linux 8 Not affected shim-unsigned-x64 Red Hat Enterprise Linux 9 Fix deferred compat-openssl11 Red Hat Enterprise Linux 9 Fix deferred edk2 Red Hat Enterprise Linux 9 Fix deferred shim Red Hat Enterprise Linux 9 Fix deferred shim-unsigned-aarch64 Red Hat Enterprise Linux 9 Fix deferred shim-unsigned-x64 Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-45446 https://nvd.nist.gov/vuln/detail/CVE-2026-45446