# CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path

> Applications using the deprecated EVP_Cipher() API with AES-OCB suffer nonce reuse and tag forgery, compromising confidentiality and integrity.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 9 Jun 2026
- **Updated:** 10 Jun 2026
- **Also known as:** ALPINE-CVE-2026-45445, AZL-89793, AZL-89876, AZL-90087, BELL-CVE-2026-45445, CLSA-2026-1782152259, DEBIAN-CVE-2026-45445, GHSA-v446-xwfm-x7mr, JLSEC-2026-1143, MINI-24m4-93f6-8qjg, MINI-rcgx-hgc5-45fx, OESA-2026-2651, OESA-2026-2875, ROOT-OS-ALPINE-317-CVE-2026-45445, UBUNTU-CVE-2026-45445

## What is CVE-2026-45445?

CVE-2026-45445 is a high-severity vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Issue summary: When an application drives an AES-OCB context through the
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the
same effective nonce regardless of the IV supplied by the caller,
resulting in (key, nonce) reuse and loss of confidentiality.  If the
same code path is used to compute the authentication tag, the tag
depends only on the (key, IV) pair and not on the plaintext or
ciphertext, allowing universal forgery of arbitrary ciphertext from a
single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming
interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level
one-shot, EVP_Cipher(), whose documentation explicitly recommends
against use by applications in favour of EVP_CipherUpdate() and
EVP_CipherFinal_ex().  The OCB provider's streaming handler flushes
the application-supplied IV into the OCB context before processing
data; the one-shot handler did not.  Every call to EVP_Cipher() on an
AES-OCB context therefore ran with the all-zero key-derived offset
state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the
authentication tag, the deferred IV setup runs at that point and
clears the running checksum that should have been accumulated over the
plaintext.  The resulting tag is a function of (key, IV) only and
verifies against any ciphertext produced under the same (key, IV)
pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a
TLS cipher suite, and libssl does not call EVP_Cipher() in any case.
Applications that drive AES-OCB through the documented streaming AEAD
API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected.  Only
applications that combine the AES-OCB cipher with the EVP_Cipher()
one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Weakness: CWE-325 (Missing Cryptographic Step)

## Which versions are affected by CVE-2026-45445?

It affects 1 product.


Products: Openssl Openssl.

## How do I fix CVE-2026-45445?

Apply the vendor's patch.

## Is CVE-2026-45445 being exploited?

There is no known exploitation of CVE-2026-45445 in the wild and no public exploit code.

## Other vulnerabilities in Openssl Openssl

- [CVE-2009-3245](https://insights.sbomify.com/CVE-2009-3245/): Null dereference in n/a (critical 10.0)
- [CVE-2006-3738](https://insights.sbomify.com/CVE-2006-3738/): Memory corruption in n/a (critical 10.0)
- [CVE-2026-63073](https://insights.sbomify.com/CVE-2026-63073/): Untrusted Sender DN Used as Format String in CMP Response Validation (critical 9.8)
- [CVE-2016-6309](https://insights.sbomify.com/CVE-2016-6309/): Use after free in n/a (critical 9.8)
- [CVE-2016-0799](https://insights.sbomify.com/CVE-2016-0799/): Integer overflow in n/a (critical 9.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-45445 and fix it if it is affected.

What it is: CVE-2026-45445 is a high-severity vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-45445 in the wild and no public exploit code.

Affected product: Openssl Openssl. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-45445/ (Markdown: https://insights.sbomify.com/CVE-2026-45445/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-45445
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45445
- OSV: https://osv.dev/vulnerability/CVE-2026-45445

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-45445/
Summaries are generated and may contain mistakes; the official description above is the record.