CVE-2026-45445

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description When using the AES-OCB cipher with the one-shot EVP Cipher() interface, the application-supplied initialisation vector (IV) is silently discarded. This causes every message encrypted with the same key to use the same effective nonce, leading to (key, nonce) reuse and a loss of confidentiality. If the same path is used to compute the authentication tag, the tag depends only on the (key, IV) pair rather than the plaintext or ciphertext, which allows for universal forgery of arbitrary ciphertext from a single captured message. This occurs because the one-shot handler fails to flush the IV into the OCB context, unlike the streaming handler. If EVP EncryptFinal ex() is later used to obtain the authentication tag, the deferred IV setup clears the running checksum that should have been accumulated over the plaintext.

Recommendations Avoid using the EVP Cipher() one-shot API with the AES-OCB cipher and instead use the documented streaming AEAD API consisting of EVP CipherUpdate() and EVP CipherFinal ex().