# CVE-2026-75803: openssl: Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying... CVE-2026-75803 is fixed in 31 products on 1 platform, first by efi-shell-aa64 2024.02-2ubuntu0.10, released August 24, 2026. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2026-75803 - Priority: Urgent - CVSS: 9.1 (critical) - EPSS: 0.0025 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 24, 2026 ## Description Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | efi-shell-aa64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-aa64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-aa64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-aa64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-aa64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-aa64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-x64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-x64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-x64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-x64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-x64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-x64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [libssl3 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 | | Linux | libssl3t64 Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [libssl3t64 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3t64-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 | | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.5 | [libssl3t64 3.5.5-1ubuntu3.5](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.5.md) | Aug 24, 2026 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.22-1~deb12u1 | [DEBIAN-CVE-2026-75803](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75803.md) | Aug 27, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u2 | [DEBIAN-CVE-2026-75803](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75803.md) | Aug 27, 2026 | | Linux | openssl Debian 14 | 3.6.4-1 | [DEBIAN-CVE-2026-75803](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75803.md) | Aug 27, 2026 | | Linux | openssl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [openssl 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [openssl 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.5 | [openssl 3.5.5-1ubuntu3.5](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.5.md) | Aug 24, 2026 | | Linux | openssl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.10.1 | [OPENSUSE-SU-2026:21744-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21744-1.md) | Sep 2, 2026 | | Linux | openssl-3 sles 15.6 | 3.1.4-150600.5.64.1 | [SUSE-SU-2026:3866-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3866-1.md) | Aug 28, 2026 | | Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.50.1 | [SUSE-SU-2026:4039-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4039-1.md) | Sep 7, 2026 | | Linux | openssl-3 sles 16.0 | 3.5.0-160000.10.1 | [SUSE-SU-2026:23609-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23609-1.md) | Sep 2, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-devel almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-libs almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-perl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.5 | [openssl-provider-legacy 3.5.5-1ubuntu3.5](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.5.md) | Aug 24, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | ovmf Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-amdsev Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-amdsev 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-amdsev-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-generic Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-generic 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-generic-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf-inteltdx Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-inteltdx 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-inteltdx-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-legacy Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-legacy 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-legacy-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf-legacy Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-legacy 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-legacy-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-aarch64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-aarch64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-aarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-aarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.