CVE-2026-88823

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An issue exists in the AES-GCM-SIV implementation where a zero-length Additional Authenticated Data (AAD) update is treated as a reset of all previously supplied AAD instead of leaving it unchanged. This causes messages to be produced or verified with authentication tags that do not cover the AAD provided before the empty fragment, allowing an attacker to forge the AAD. Additionally, AAD was not reset during context re-initialisation, meaning AAD from previous context usage was incorrectly included in new messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.