{"id":"CVE-2026-88823","kind":"vulnerability","aliases":["CVE-2026-88823"],"related":[],"title":"OpenSSL: zero-length AAD update drops earlier AES-GCM-SIV authenticated data","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary.","summary":"OpenSSL's AES-GCM-SIV implementation treats an empty Additional Authenticated Data update as a reset, so AAD supplied in earlier fragments is no longer covered by the tag. An attacker can forge the AAD of affected messages, and stale AAD from a previous context can leak into a new one.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenSSL","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aes-gcm-siv","cryptography","openssl","package"],"not_affected_if":["fips-module","no-aes-gcm-siv","single-aad-update"],"how_to_check":"- Check whether the application uses AES-GCM-SIV through OpenSSL with `openssl version`\n- Look for code that calls AAD update in multiple chunks, where a chunk may be empty","fix":null,"status":"open","published_at":"2026-11-10T19:21:34+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T20:04:45+00:00","updated_at":"2026-11-10T20:04:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T20:04:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"OpenSSL: zero-length AAD update drops earlier AES-GCM-SIV authenticated data","impact":"medium","summary":"OpenSSL's AES-GCM-SIV implementation treats an empty Additional Authenticated Data update as a reset, so AAD supplied in earlier fragments is no longer covered by the tag. An attacker can forge the AAD of affected messages, and stale AAD from a previous context can leak into a new one.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openssl","aes-gcm-siv","cryptography"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker forges authenticated data accepted as genuine","analyst_note":"Confirm affected OpenSSL version ranges and fixed versions from the NVD entry and the linked patch commits on github.com.","how_to_check":"- Check whether the application uses AES-GCM-SIV through OpenSSL with `openssl version`\n- Look for code that calls AAD update in multiple chunks, where a chunk may be empty\n- unknown for other checks, since the sources do not say","plain_action":"","product_name":"OpenSSL","needs_analyst":true,"not_affected_if":["no-aes-gcm-siv","single-aad-update","fips-module"],"who_is_affected":"Applications that use AES-GCM-SIV through OpenSSL and pass AAD in several fragments, one of them empty, are exposed. The fix makes an empty AAD update a no-op and clears AAD on re-initialisation with a key or nonce. Applications that do not use AES-GCM-SIV, or that pass AAD in a single update, are not affected. The FIPS modules are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000827,"input_tokens":4958,"output_tokens":663,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-325':174C '-88823':17A,20A 'aad':5A,47B,64B,70B,97C,105C,113C,120C,141C,167C,182C,196C,207C,215C,227C,239C,249C,273C 'accumul':216C,248C 'addit':39B,94C 'ae':10A,23B,32B,85C,285C 'aes-gcm-siv':9A,22B,31B,84C,284C 'affect':66B,282C 'algorithm':293C 'alongsid':155C 'also':200C,223C 'applic':116C,151C,180C 'approv':292C 'attack':60B,163C 'authent':13A,40B,95C,135C,154C 'boundari':307C 'chang':269C 'chunk':185C,197C 'clear':246C 'context':74B,202C,220C,252C 'cover':55B,139C 'cryptograph':176C 'cryptographi':26B 'cve':15A,18A 'cwe':172C,173C 'data':14A,41B,96C,149C 'default':300C 'descript':178C 'drop':7A 'earlier':8A,50B 'effect':198C 'empti':38B,128C,145C 'far':108C 'fip':274C,278C,291C,305C 'fix':233C 'forg':62B,165C 'fragment':51B,123C,146C 'gcm':11A,24B,33B,86C,286C 'impact':147C,275C 'implement':35B,88C,296C 'includ':224C 'initialis':205C,256C,266C 'instead':109C 'intend':152C 'issu':81C 'keep':271C 'key':259C 'leak':76B 'leav':111C 'left':160C 'length':4A,93C,191C,238C 'longer':54B 'make':234C 'meant':212C 'messag':67B,133C,157C,171C,231C 'miss':175C 'modul':279C,306C 'multipl':184C 'new':79B,230C 'no-op':242C 'nonc':262C 'one':80B,124C 'op':244C 'openssl':1A,21A,27B,29B,304C 'outsid':302C 'packag':28B 'paramet':270C 'pass':181C 'previous':73B,195C,219C 'produc':130C 'provid':301C 're':204C,255C,265C 're-initialis':203C,254C,264C 'reset':45B,101C,210C 'sever':122C 'silent':159C 'siv':12A,25B,34B,87C,287C 'stale':69B 'step':177C 'summari':82C,148C 'suppli':48B,106C,118C,142C 'tag':58B,136C 'therefor':129C 'treat':36B,89C 'unauthent':161C,199C 'unchang':114C 'updat':6A,42B,98C,240C 'usag':221C 'verifi':132C 'whenev':250C 'whose':134C 'zero':3A,92C,190C,237C 'zero-length':2A,91C,236C","nicknames":[],"mitigations":[],"who_affected":"Applications that use AES-GCM-SIV through OpenSSL and pass AAD in several fragments, one of them empty, are exposed. The fix makes an empty AAD update a no-op and clears AAD on re-initialisation with a key or nonce. Applications that do not use AES-GCM-SIV, or that pass AAD in a single update, are not affected. The FIPS modules are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["openssl"],"ptokens":["openssl"],"labels":["aesgcmsiv","cryptography","medium","openssl","package","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-88823':17A,20A 'aad':5A 'ae':10A 'aes-gcm-siv':9A 'authent':13A 'cve':15A,18A 'data':14A 'drop':7A 'earlier':8A 'gcm':11A 'length':4A 'openssl':1A,21A 'siv':12A 'updat':6A 'zero':3A 'zero-length':2A","search_b":"'aad':47B,64B,70B 'addit':39B 'ae':23B,32B 'aes-gcm-siv':22B,31B 'affect':66B 'attack':60B 'authent':40B 'context':74B 'cover':55B 'cryptographi':26B 'data':41B 'earlier':50B 'empti':38B 'forg':62B 'fragment':51B 'gcm':24B,33B 'implement':35B 'leak':76B 'longer':54B 'messag':67B 'new':79B 'one':80B 'openssl':27B,29B 'packag':28B 'previous':73B 'reset':45B 'siv':25B,34B 'stale':69B 'suppli':48B 'tag':58B 'treat':36B 'updat':42B","search_c":"'-325':174C 'aad':97C,105C,113C,120C,141C,167C,182C,196C,207C,215C,227C,239C,249C,273C 'accumul':216C,248C 'addit':94C 'ae':85C,285C 'aes-gcm-siv':84C,284C 'affect':282C 'algorithm':293C 'alongsid':155C 'also':200C,223C 'applic':116C,151C,180C 'approv':292C 'attack':163C 'authent':95C,135C,154C 'boundari':307C 'chang':269C 'chunk':185C,197C 'clear':246C 'context':202C,220C,252C 'cover':139C 'cryptograph':176C 'cwe':172C,173C 'data':96C,149C 'default':300C 'descript':178C 'effect':198C 'empti':128C,145C 'far':108C 'fip':274C,278C,291C,305C 'fix':233C 'forg':165C 'fragment':123C,146C 'gcm':86C,286C 'impact':147C,275C 'implement':88C,296C 'includ':224C 'initialis':205C,256C,266C 'instead':109C 'intend':152C 'issu':81C 'keep':271C 'key':259C 'leav':111C 'left':160C 'length':93C,191C,238C 'make':234C 'meant':212C 'messag':133C,157C,171C,231C 'miss':175C 'modul':279C,306C 'multipl':184C 'new':230C 'no-op':242C 'nonc':262C 'one':124C 'op':244C 'openssl':304C 'outsid':302C 'paramet':270C 'pass':181C 'previous':195C,219C 'produc':130C 'provid':301C 're':204C,255C,265C 're-initialis':203C,254C,264C 'reset':101C,210C 'sever':122C 'silent':159C 'siv':87C,287C 'step':177C 'summari':82C,148C 'suppli':106C,118C,142C 'tag':136C 'therefor':129C 'treat':89C 'unauthent':161C,199C 'unchang':114C 'updat':98C,240C 'usag':221C 'verifi':132C 'whenev':250C 'whose':134C 'zero':92C,190C,237C 'zero-length':91C,236C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","severity":null,"published_at":"2026-11-10T19:21:34+00:00","modified_at":"2026-11-10T19:21:34+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null}],"documents":[{"id":117519,"url":"https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117520,"url":"https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117521,"url":"https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}