CVE-2026-6331

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists in the EVP DigestVerifyFinal() function where a zero-length tag could be accepted as valid during HMAC (Hash-based Message Authentication Code) verification. In the OpenSSL-compatibility HMAC verify path, the supplied signature length was only checked to ensure it did not exceed the MAC length, allowing a zero-length or truncated tag to pass verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.