CVE-2026-45445
Detail
Description
Issue summary: When an application drives an AES-OCB context through the
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector (IV) is silently discarded.
Impact summary: Every message encrypted under the same key uses the
same effective nonce regardless of the IV supplied by the caller,
resulting in (key, nonce) reuse and loss of confidentiality. If the
same code path is used to compute the authentication tag, the tag
depends only on the (key, IV) pair and not on the plaintext or
ciphertext, allowing universal forgery of arbitrary ciphertext from a
single captured message.
OpenSSL provides two ways to drive a cipher: the documented streaming
interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level
one-shot, EVP_Cipher(), whose documentation explicitly recommends
against use by applications in favour of EVP_CipherUpdate() and
EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes
the application-supplied IV into the OCB context before processing
data; the one-shot handler did not. Every call to EVP_Cipher() on an
AES-OCB context therefore ran with the all-zero key-derived offset
state left by cipher initialisation, regardless of the caller's IV.
If EVP_EncryptFinal_ex() is subsequently used to obtain the
authentication tag, the deferred IV setup runs at that point and
clears the running checksum that should have been accumulated over the
plaintext. The resulting tag is a function of (key, IV) only and
verifies against any ciphertext produced under the same (key, IV)
pair.
The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a
TLS cipher suite, and libssl does not call EVP_Cipher() in any case.
Applications that drive AES-OCB through the documented streaming AEAD
API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only
applications that combine the AES-OCB cipher with the EVP_Cipher()
one-shot API are vulnerable.
The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Weakness Enumeration
| CWE-ID |
CWE Name |
Source |
|
CWE-325
|
Missing Cryptographic Step |
OpenSSL Software Foundation
|
Change History
6 change records found show changes
CVE Modified by CISA-ADP
6/17/2026 6:52:03 AM
| Action |
Type |
Old Value |
New Value |
| Added |
SSVC |
{"timestamp":"2026-06-09T19:22:47.789275Z","id":"CVE-2026-45445","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}
|
CVE Modified by OpenSSL Software Foundation
6/17/2026 6:52:03 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.1","versionType":"semver","status":"affected"},{"version":"3.6.0","lessThan":"3.6.3","versionType":"semver","status":"affected"},{"version":"3.5.0","lessThan":"3.5.7","versionType":"semver","status":"affected"},{"version":"3.4.0","lessThan":"3.4.6","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.21","versionType":"semver","status":"affected"}]}]
|
Initial Analysis by NIST
6/15/2026 10:57:17 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
OR
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
*cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/983d54b5cce8d16147548ed1a37892d1720bbab6 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory
|
CVE Modified by OpenSSL Software Foundation
6/10/2026 4:16:24 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://github.com/openssl/openssl/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/983d54b5cce8d16147548ed1a37892d1720bbab6
|
| Removed |
Reference |
https://github.com/openssl/security/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
|
| Removed |
Reference |
https://github.com/openssl/security/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
|
| Removed |
Reference |
https://github.com/openssl/security/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
|
| Removed |
Reference |
https://github.com/openssl/security/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
|
| Removed |
Reference |
https://github.com/openssl/security/commit/983d54b5cce8d16147548ed1a37892d1720bbab6
|
CVE Modified by CISA-ADP
6/09/2026 4:16:57 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
New CVE Received from OpenSSL Software Foundation
6/09/2026 1:17:18 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Description |
Record truncated, showing 2048 of 2068 characters.
View Entire Change Record
Issue summary: When an application drives an AES-OCB context through the
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector (IV) is silently discarded.
Impact summary: Every message encrypted under the same key uses the
same effective nonce regardless of the IV supplied by the caller,
resulting in (key, nonce) reuse and loss of confidentiality. If the
same code path is used to compute the authentication tag, the tag
depends only on the (key, IV) pair and not on the plaintext or
ciphertext, allowing universal forgery of arbitrary ciphertext from a
single captured message.
OpenSSL provides two ways to drive a cipher: the documented streaming
interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level
one-shot, EVP_Cipher(), whose documentation explicitly recommends
against use by applications in favour of EVP_CipherUpdate() and
EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes
the application-supplied IV into the OCB context before processing
data; the one-shot handler did not. Every call to EVP_Cipher() on an
AES-OCB context therefore ran with the all-zero key-derived offset
state left by cipher initialisation, regardless of the caller's IV.
If EVP_EncryptFinal_ex() is subsequently used to obtain the
authentication tag, the deferred IV setup runs at that point and
clears the running checksum that should have been accumulated over the
plaintext. The resulting tag is a function of (key, IV) only and
verifies against any ciphertext produced under the same (key, IV)
pair.
The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a
TLS cipher suite, and libssl does not call EVP_Cipher() in any case.
Applications that drive AES-OCB through the documented streaming AEAD
API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only
applications that combine the AES-OCB cipher with the EVP_Cipher()
one-shot API are vulnerable.
The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
this issue, as AES-OCB is outside the OpenSSL F
|
| Added |
CWE |
CWE-325
|
| Added |
Reference |
https://github.com/openssl/security/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
|
| Added |
Reference |
https://github.com/openssl/security/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
|
| Added |
Reference |
https://github.com/openssl/security/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
|
| Added |
Reference |
https://github.com/openssl/security/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
|
| Added |
Reference |
https://github.com/openssl/security/commit/983d54b5cce8d16147548ed1a37892d1720bbab6
|
| Added |
Reference |
https://openssl-library.org/news/secadv/20260609.txt
|
Quick Info
CVE Dictionary Entry: CVE-2026-45445 NVD
Published Date: 06/09/2026 NVD
Last Modified: 06/17/2026
Source: OpenSSL Software Foundation
|
