CVE-2026-88823

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88823
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88823.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88823
Downstream
Published
2026-11-10T18:15:49Z
Modified
2026-11-12T07:04:12Z
Summary
AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update
Details

Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.

Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.

CWE: CWE-325: Missing Cryptographic Step

Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.

The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.

FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary.

Database specific 
{
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-325"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88823.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.1.0"
                        },
                        {
                            "fixed": "4.1.1"
                        },
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "fixed": "4.0.4"
                        },
                        {
                            "introduced": "3.5.0"
                        },
                        {
                            "fixed": "3.5.10"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6747b1a278816dd7db46438040a70b0b5e5e0a90
Fixed
2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682
Fixed
159e1de0c448d7b9f09ad768c8e141def4aa1eb4
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "6747b1a278816dd7db46438040a70b0b5e5e0a90"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "159e1de0c448d7b9f09ad768c8e141def4aa1eb4"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0-POST-CLANG-FORMAT-WEBKIT
4.0-PRE-CLANG-FORMAT-WEBKIT
Other
BEFORE_engine
OpenSSL_0_9_1c
OpenSSL_0_9_2b
OpenSSL_0_9_3
OpenSSL_0_9_3a
OpenSSL_0_9_3beta2
OpenSSL_0_9_4
OpenSSL_0_9_5a
OpenSSL_0_9_5a-beta1
OpenSSL_0_9_5a-beta2
OpenSSL_0_9_5beta1
OpenSSL_0_9_5beta2
OpenSSL_0_9_6-beta3
OpenSSL_1_1_0-pre1
OpenSSL_1_1_0-pre2
OpenSSL_1_1_0-pre3
OpenSSL_1_1_0-pre4
OpenSSL_1_1_0-pre5
OpenSSL_1_1_0-pre6
OpenSSL_1_1_1
OpenSSL_1_1_1-pre1
OpenSSL_1_1_1-pre2
OpenSSL_1_1_1-pre3
OpenSSL_1_1_1-pre4
OpenSSL_1_1_1-pre5
OpenSSL_1_1_1-pre6
OpenSSL_1_1_1-pre7
OpenSSL_1_1_1-pre8
OpenSSL_1_1_1-pre9
master-post-auto-reformat
master-post-reformat
master-pre-auto-reformat
master-pre-reformat
openssl-3.*
openssl-3.0.0-alpha1
openssl-3.0.0-alpha10
openssl-3.0.0-alpha11
openssl-3.0.0-alpha12
openssl-3.0.0-alpha13
openssl-3.0.0-alpha14
openssl-3.0.0-alpha15
openssl-3.0.0-alpha16
openssl-3.0.0-alpha17
openssl-3.0.0-alpha2
openssl-3.0.0-alpha3
openssl-3.0.0-alpha4
openssl-3.0.0-alpha5
openssl-3.0.0-alpha6
openssl-3.0.0-alpha7
openssl-3.0.0-alpha8
openssl-3.0.0-alpha9
openssl-3.0.0-beta1
openssl-3.0.0-beta2
openssl-3.2.0-alpha1
openssl-3.2.0-alpha2
openssl-3.4.0-alpha1
openssl-3.5.0
openssl-3.5.0-alpha1
openssl-3.5.0-beta1
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.5.8
openssl-3.5.9
openssl-4.*
openssl-4.0.0
openssl-4.0.0-alpha1
openssl-4.0.0-beta1
openssl-4.0.1
openssl-4.0.2
openssl-4.0.3
openssl-4.1.0
openssl-4.1.0-alpha1
openssl-4.1.0-beta1
openssl-4.1.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88823.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "285948039298549643612817077998273913650",
                "18393129956023783410016987406074355400",
                "111804283033994290460391257417044731890"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88823-1d49bab8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "220952839793944656931711616226500379097",
                "183621407091970049652512894964820274083",
                "324396409977007666933540705194597790663",
                "275797815300862706785705825884699225609",
                "156083159962035213558824009374814332865",
                "140949942162426397355395579122284180555",
                "178818428534745940263737234110884441984",
                "142672002434670775990642954254810590791",
                "24004171727642236108968238683202017912"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88823-27b6b1ba",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149863074105794192880207605547302460431",
            "length": 655
        },
        "id": "CVE-2026-88823-33fe3e58",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_aad"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "220952839793944656931711616226500379097",
                "183621407091970049652512894964820274083",
                "324396409977007666933540705194597790663",
                "275797815300862706785705825884699225609",
                "156083159962035213558824009374814332865",
                "140949942162426397355395579122284180555",
                "178818428534745940263737234110884441984",
                "142672002434670775990642954254810590791",
                "24004171727642236108968238683202017912"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88823-354f7373",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "220952839793944656931711616226500379097",
                "183621407091970049652512894964820274083",
                "324396409977007666933540705194597790663",
                "275797815300862706785705825884699225609",
                "156083159962035213558824009374814332865",
                "140949942162426397355395579122284180555",
                "178818428534745940263737234110884441984",
                "142672002434670775990642954254810590791",
                "24004171727642236108968238683202017912"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88823-3f6726af",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47240869671165829835389719198196110038",
            "length": 727
        },
        "id": "CVE-2026-88823-467b30be",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv.c",
            "function": "ossl_aes_gcm_siv_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "285948039298549643612817077998273913650",
                "18393129956023783410016987406074355400",
                "111804283033994290460391257417044731890"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88823-6b9d6c38",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47240869671165829835389719198196110038",
            "length": 727
        },
        "id": "CVE-2026-88823-78f75289",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv.c",
            "function": "ossl_aes_gcm_siv_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149863074105794192880207605547302460431",
            "length": 655
        },
        "id": "CVE-2026-88823-79dac49d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_aad"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "285948039298549643612817077998273913650",
                "18393129956023783410016987406074355400",
                "111804283033994290460391257417044731890"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88823-cc7cc3e1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47240869671165829835389719198196110038",
            "length": 727
        },
        "id": "CVE-2026-88823-ed17b647",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv.c",
            "function": "ossl_aes_gcm_siv_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149863074105794192880207605547302460431",
            "length": 655
        },
        "id": "CVE-2026-88823-f2894575",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_aad"
        }
    }
]
vanir_signatures_modified 
"2026-11-12T07:04:12Z"