CVE-2026-75803

*** Pendiente de traducción *** Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty<br /> ciphertext can report success without verifying the supplied authentication<br /> tag when the operation is finalized by calling the EVP_Cipher() function.<br /> <br /> Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and<br /> expecting the call to check the AEAD tag may accept forged messages.<br /> <br /> CWE: CWE-354 (Improper Validation of Integrity Check Value)<br /> <br /> Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one<br /> shot encryption and decryption call. It also verifies the AEAD tag after the<br /> decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers<br /> it skipped the AEAD tag verification when an empty ciphertext was passed to<br /> the function. The callers of this function might believe that a successful<br /> return indicates a valid AEAD tag for these ciphers, even when that has not<br /> truly been validated in this case.<br /> <br /> FIPS impact: no<br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE<br /> as the affected algorithms are not FIPS approved and thus not implemented<br /> in the FIPS module.