An issue exists in the AES-GCM-SIV implementation where a zero-length Additional Authenticated Data (AAD) update is treated as a reset of all previously supplied AAD instead of leaving it unchanged. This causes messages to be produced or verified with authentication tags that do not cover the AAD provided before the empty fragment, allowing an attacker to forge the AAD. Additionally, AAD was not reset during context re-initialisation, meaning AAD from previous context usage was incorrectly included in new messages.