CVE-2026-45446

/// Technical description

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV

(RFC 8452) mishandle the authentication of AAD (Additional Authenticated

Data) with an empty ciphertext allowing a forgery of such messages.

Impact summary: An attacker can forge empty messages with arbitrary AAD

to the victim's application using these ciphers.

AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD

modes: they accept a key, nonce, optional AAD (bytes that are authenticated

but not encrypted), and plaintext, and produces ciphertext plus a 16-byte

tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only

if the tag is verified succesfully.

In OpenSSL's provider implementation of these ciphers, the expected tag is

computed only when decryption function is invoked with non-empty data.

If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without

invocation of the ciphertext update, which can happen when the received

ciphertext length is zero, t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References