---
id: "CVE-2026-88823"
page: "https://infrastack.ai/live/CVE-2026-88823"
kind: "vulnerability"
aliases: ["CVE-2026-88823"]
title: "OpenSSL: zero-length AAD update drops earlier AES-GCM-SIV authenticated data"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "OpenSSL", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aes-gcm-siv", "cryptography", "openssl", "package"]
not_affected_if: ["fips-module", "no-aes-gcm-siv", "single-aad-update"]
published_at: "2026-11-10T19:21:34+00:00"
first_seen_at: "2026-11-10T19:25:21+00:00"
updated_at: "2026-11-10T20:04:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88823", "first_seen_at": "2026-11-10T19:25:21+00:00"}]
exploit_sources: []
---

# OpenSSL: zero-length AAD update drops earlier AES-GCM-SIV authenticated data

Link for people: https://infrastack.ai/live/CVE-2026-88823 (this .md is for agents)

OpenSSL's AES-GCM-SIV implementation treats an empty Additional Authenticated Data update as a reset, so AAD supplied in earlier fragments is no longer covered by the tag. An attacker can forge the AAD of affected messages, and stale AAD from a previous context can leak into a new one.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenSSL affected range not listed fixed no fixed version listed

## How to check

- Check whether the application uses AES-GCM-SIV through OpenSSL with `openssl version`
- Look for code that calls AAD update in multiple chunks, where a chunk may be empty

## Timeline

- 2026-11-10T19:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88823

## Documents

- [fix] Patch: github.com https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4
- [fix] Patch: github.com https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682
- [fix] Patch: github.com https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90

## From the sources

Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional
Authenticated Data (AAD) update as a reset of all the AAD supplied so far,
instead of leaving the AAD unchanged. An application that supplies its AAD in
several fragments, one of which is empty, therefore produces or verifies
messages whose authentication tag does not cover the AAD supplied before
the empty fragment.

Impact summary: Data an application intended to authenticate alongside a
message is silently left unauthenticated. An attacker can forge the AAD of such
a message.

CWE: CWE-325: Missing Cryptographic Step

Description: An application passing AAD in multiple chunks of which some have
zero length will have the previous AAD chunks effectively unauthenticated. Also,
on context re-initialisation, the AAD was not reset, which meant that any AAD
accumulated from the previous context usage were also included in the AAD of the
new message.

The fix makes a zero-length AAD update a no-op and clears any accumulated AAD
whenever the context is re-initialised with a key or a nonce.
A re-initialisation that only changes parameters keeps the AAD.

FIPS impact: no
The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved
algorithm and is implemented only in the default provider, outside the
OpenSSL FIPS module boundary.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_