CVE-2026-34182

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform<br /> sufficient input validation on the cipher and tag length fields of<br /> AuthEnvelopedData containers, leading to various potential compromises.<br /> <br /> Impact Summary: Attackers making use of these vulnerabilities may achieve<br /> key-equivalent functionality for a given CMS recipient and/or bypass integrity<br /> validation for a given message.<br /> <br /> In one use case, an attacker may send a CMS message containing<br /> AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL<br /> erroneously allows this selection, and attempts to decrypt and validate the<br /> message.<br /> <br /> An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData<br /> addressed to the victim can re-emit it with the recipientInfos set left<br /> byte-for-byte intact, so the victim&amp;#39;s private key still unwraps the genuine CEK<br /> (the content-encryption key), but with the inner OID rewritten to AES-256-OFB<br /> (Output Feedback Mode, an unauthenticated keystream mode) and with an<br /> attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the<br /> real CEK, never consults the MAC field, and CMS_decrypt() returns success.<br /> <br /> If the application under attack responds to the attacker with any indicator<br /> showing success or failure of the decryption effort, it is possible for the<br /> attacker to use this as an oracle to obtain key equivalent functionality for the<br /> CEK used for the chosen recipient of the message.<br /> <br /> In another use case, an attacker can reduce the tag length of the chosen AEAD<br /> cipher for a given AuthEnvelopedData container to be a single byte long,<br /> allowing an attacker to brute force CMS decryption, producing an integrity<br /> bypass for applications that trust CMS_decrypt() to reject modified content.<br /> <br /> The FIPS modules are not affected by this issue.