CVE-2026-75803: 
Ruby vulnerability analysis and mitigation

CVE-2026-75803 is an AEAD authentication tag bypass vulnerability in OpenSSL affecting the EVP_Cipher() API when used with ChaCha20-Poly1305 and AES-OCB ciphers. When decrypting an empty ciphertext, these cipher implementations took an early exit and returned success without verifying the supplied authentication tag, allowing forged messages to be accepted as valid. Affected versions include OpenSSL 3.0.0–3.0.21, 3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, and 4.0.0–4.0.1. The vulnerability was disclosed on August 25, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, OpenSSL Advisory).

The root cause is classified as CWE-354 (Improper Validation of Integrity Check Value). The EVP_Cipher() API is designed to behave as a one-shot encrypt/decrypt call that also verifies the AEAD tag upon finalization. However, in the chacha20_poly1305_cipher and aes_ocb_cipher callbacks, a zero-length input (inl == 0 or in == NULL) triggered an early return of success before the tag comparison was performed — effectively skipping authentication entirely. The fix, applied across multiple backport commits, routes NULL-input terminal calls through the proper finalize path (aes_ocb_block_final) and introduces a dedicated chacha20_poly1305_update callback to separate zero-length update no-ops from the one-shot cipher path that must check the tag (OpenSSL Commit 6c7aa6f, OpenSSL Commit bdeb0cd). AES-GCM-SIV was also found to fail to generate a tag on an empty-message encrypt operation and was corrected in the same patch set. The FIPS modules are not affected because ChaCha20-Poly1305 and AES-OCB are not FIPS-approved algorithms (OpenSSL Advisory).

Successful exploitation allows an attacker to forge authenticated messages that will be accepted as valid by applications using EVP_Cipher() with ChaCha20-Poly1305 or AES-OCB for decryption of empty ciphertexts. This undermines both confidentiality (an attacker can inject unauthenticated data that is treated as trusted) and integrity (message authentication is completely bypassed for the affected case), with a high impact on both dimensions per the CVSS scoring. Applications relying on AEAD for secure channel establishment, token validation, or data integrity checks are at risk of accepting forged or tampered messages without any indication of failure (GitHub Advisory, OpenSSL Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is automatable (no user interaction required) and exploitable over the network without authentication, but is constrained to applications that specifically call EVP_Cipher() with an empty ciphertext and rely on the return value to confirm tag validity. The EPSS score is approximately 0.116%, reflecting low current exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a vulnerable target: Locate an application that uses OpenSSL's EVP_Cipher() API with ChaCha20-Poly1305 or AES-OCB in decryption mode and processes messages that may have an empty ciphertext (e.g., authentication-only messages or empty payload tokens).
2. Craft a forged message: Construct a message with an empty ciphertext body and an arbitrary (invalid or random) authentication tag. The AEAD tag does not need to be correct because the vulnerable code path skips tag verification entirely for empty ciphertexts.
3. Submit the forged message: Send the crafted message to the target application through whatever protocol or interface it exposes (e.g., a network API, TLS session, or file-based input).
4. Observe acceptance: Because EVP_Cipher() returns success without verifying the tag, the application treats the forged message as authenticated and valid, potentially granting unauthorized access, injecting malicious data, or bypassing integrity checks (OpenSSL Commit 6c7aa6f, OpenSSL Advisory).

OpenSSL has released patched versions addressing this vulnerability: 3.0.22, 3.4.7, 3.5.8, 3.6.4, and 4.0.2. Upgrading to one of these versions is the recommended remediation. As a defense-in-depth measure, application developers should review any code that calls EVP_Cipher() with ChaCha20-Poly1305 or AES-OCB and consider adding explicit application-level AEAD tag validation. Linux distributions including Ubuntu (USN-8678-1, USN-8678-3), SUSE (SUSE-SU-2026:3876-1), and openSUSE have also released updated packages (OpenSSL Advisory, Ubuntu Advisory, SUSE Advisory).

The vulnerability received coverage from security news outlets including CyberSecurityNews and GBHackers, which reported on the broader batch of OpenSSL fixes released alongside this CVE (CyberSecurityNews, GBHackers). The OpenSSL project disclosed the issue through its standard security advisory process, and the fix was reviewed by core maintainers Tomas Mraz and Milan Broz (OpenSSL Commit 6c7aa6f). Distribution vendors including Ubuntu, SUSE, openSUSE, Alpine, and FreeBSD promptly issued updated packages, indicating broad ecosystem awareness and response.