CVE-2026-88823
Received
Received - Intake
AES-GCM-SIV AAD Handling Flaw in OpenSSL
Vulnerability report for CVE-2026-88823, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-10
Last updated on: 2026-11-10
Assigner: OpenSSL Software Foundation
Description
Description
Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional
Authenticated Data (AAD) update as a reset of all the AAD supplied so far,
instead of leaving the AAD unchanged. An application that supplies its AAD in
several fragments, one of which is empty, therefore produces or verifies
messages whose authentication tag does not cover the AAD supplied before
the empty fragment.
Impact summary: Data an application intended to authenticate alongside a
message is silently left unauthenticated. An attacker can forge the AAD of such
a message.
CWE: CWE-325: Missing Cryptographic Step
Description: An application passing AAD in multiple chunks of which some have
zero length will have the previous AAD chunks effectively unauthenticated. Also,
on context re-initialisation, the AAD was not reset, which meant that any AAD
accumulated from the previous context usage were also included in the AAD of the
new message.
The fix makes a zero-length AAD update a no-op and clears any accumulated AAD
whenever the context is re-initialised with a key or a nonce.
A re-initialisation that only changes parameters keeps the AAD.
FIPS impact: no
The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved
algorithm and is implemented only in the default provider, outside the
OpenSSL FIPS module boundary.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-325 | The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. |
