UpHeron
All vulnerabilities

Servers and applications

CVE-2026-45445

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same…

Severity
High 7.5
Published
9 Jun 2026
Last changed
23 Jul 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.0.21, 3.4.6, 3.5.7, 3.6.3
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 3.0.0 before 3.0.21
  • From 3.4.0 before 3.4.6
  • From 3.5.0 before 3.5.7
  • From 3.6.0 before 3.6.3
  • Version 4.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-45445
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-45445