CVE-2026-34182
Detail
Description
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform
sufficient input validation on the cipher and tag length fields of
AuthEnvelopedData containers, leading to various potential compromises.
Impact Summary: Attackers making use of these vulnerabilities may achieve
key-equivalent functionality for a given CMS recipient and/or bypass integrity
validation for a given message.
In one use case, an attacker may send a CMS message containing
AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL
erroneously allows this selection, and attempts to decrypt and validate the
message.
An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData
addressed to the victim can re-emit it with the recipientInfos set left
byte-for-byte intact, so the victim's private key still unwraps the genuine CEK
(the content-encryption key), but with the inner OID rewritten to AES-256-OFB
(Output Feedback Mode, an unauthenticated keystream mode) and with an
attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the
real CEK, never consults the MAC field, and CMS_decrypt() returns success.
If the application under attack responds to the attacker with any indicator
showing success or failure of the decryption effort, it is possible for the
attacker to use this as an oracle to obtain key equivalent functionality for the
CEK used for the chosen recipient of the message.
In another use case, an attacker can reduce the tag length of the chosen AEAD
cipher for a given AuthEnvelopedData container to be a single byte long,
allowing an attacker to brute force CMS decryption, producing an integrity
bypass for applications that trust CMS_decrypt() to reject modified content.
The FIPS modules are not affected by this issue.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Weakness Enumeration
| CWE-ID |
CWE Name |
Source |
|
CWE-354
|
Improper Validation of Integrity Check Value |
OpenSSL Software Foundation
|
Change History
6 change records found show changes
CVE Modified by CISA-ADP
6/17/2026 6:38:36 AM
| Action |
Type |
Old Value |
New Value |
| Added |
SSVC |
{"timestamp":"2026-06-10T15:58:17.905043Z","id":"CVE-2026-34182","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}
|
CVE Modified by OpenSSL Software Foundation
6/17/2026 6:38:36 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.1","versionType":"semver","status":"affected"},{"version":"3.6.0","lessThan":"3.6.3","versionType":"semver","status":"affected"},{"version":"3.5.0","lessThan":"3.5.7","versionType":"semver","status":"affected"},{"version":"3.4.0","lessThan":"3.4.6","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.21","versionType":"semver","status":"affected"}]}]
|
Initial Analysis by NIST
6/15/2026 2:13:05 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
OR
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
*cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory
|
CVE Modified by CISA-ADP
6/10/2026 1:16:32 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
CVE Modified by OpenSSL Software Foundation
6/10/2026 4:16:22 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0
|
| Removed |
Reference |
https://github.com/openssl/security/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
|
| Removed |
Reference |
https://github.com/openssl/security/commit/439ed7d2c0962ce964482727264668bf277c333f
|
| Removed |
Reference |
https://github.com/openssl/security/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
|
| Removed |
Reference |
https://github.com/openssl/security/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
|
| Removed |
Reference |
https://github.com/openssl/security/commit/d2ca86bcd43e4f17d899f347101766b6107676e0
|
New CVE Received from OpenSSL Software Foundation
6/09/2026 1:17:04 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Description |
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform
sufficient input validation on the cipher and tag length fields of
AuthEnvelopedData containers, leading to various potential compromises.
Impact Summary: Attackers making use of these vulnerabilities may achieve
key-equivalent functionality for a given CMS recipient and/or bypass integrity
validation for a given message.
In one use case, an attacker may send a CMS message containing
AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL
erroneously allows this selection, and attempts to decrypt and validate the
message.
An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData
addressed to the victim can re-emit it with the recipientInfos set left
byte-for-byte intact, so the victim's private key still unwraps the genuine CEK
(the content-encryption key), but with the inner OID rewritten to AES-256-OFB
(Output Feedback Mode, an unauthenticated keystream mode) and with an
attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the
real CEK, never consults the MAC field, and CMS_decrypt() returns success.
If the application under attack responds to the attacker with any indicator
showing success or failure of the decryption effort, it is possible for the
attacker to use this as an oracle to obtain key equivalent functionality for the
CEK used for the chosen recipient of the message.
In another use case, an attacker can reduce the tag length of the chosen AEAD
cipher for a given AuthEnvelopedData container to be a single byte long,
allowing an attacker to brute force CMS decryption, producing an integrity
bypass for applications that trust CMS_decrypt() to reject modified content.
The FIPS modules are not affected by this issue.
|
| Added |
CWE |
CWE-354
|
| Added |
Reference |
https://github.com/openssl/security/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
|
| Added |
Reference |
https://github.com/openssl/security/commit/439ed7d2c0962ce964482727264668bf277c333f
|
| Added |
Reference |
https://github.com/openssl/security/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
|
| Added |
Reference |
https://github.com/openssl/security/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
|
| Added |
Reference |
https://github.com/openssl/security/commit/d2ca86bcd43e4f17d899f347101766b6107676e0
|
| Added |
Reference |
https://openssl-library.org/news/secadv/20260609.txt
|
Quick Info
CVE Dictionary Entry: CVE-2026-34182 NVD
Published Date: 06/09/2026 NVD
Last Modified: 06/17/2026
Source: OpenSSL Software Foundation
|
