CVE-2026-45446

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45446
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45446.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-45446
Downstream
Related
Published
2026-06-09T16:03:32.120Z
Modified
2026-07-17T21:02:28.722252562Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes
Details

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages.

Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers.

AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, EVP_DecryptFinal_ex() is documented to return success only if the tag is verified succesfully.

In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls EVP_DecryptFinal_ex() without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value.

When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key.

AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2.

No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.

Database specific 
{
    "cwe_ids": [
        "CWE-325"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45446.json",
    "cna_assigner": "openssl"
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
89cd17a031e022211684eb7eb41190cf1910f9fa
Fixed
51ea949dc1436e865935b47874b21a3bb31a102e
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
c5ea1cc227fd60afae8ac4b9438690bbe4888f79
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
8cf17aaeb4599f8af87fefd810b5b5fee90fe69e
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f
Introduced
11b7b6ea3b65a584e1d31408ed1bdb139465cffd
Fixed
25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
Fixed
71e2a5d263518cf5866043bd60ee4994d59e53a3
Fixed
7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85
Fixed
daca0f48e4a69a2892a62262bad59e62a8a76598
Fixed
eec5e9bf0d867333b8495e456f5235d225798a68
Database specific 
{
    "cpe": [
        "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.21"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.6"
        },
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.7"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.3"
        },
        {
            "introduced": "4.0.0-NA"
        },
        {
            "last_affected": "4.0.0-NA"
        }
    ]
}

Affected versions

3.*
3.0-POST-CLANG-FORMAT-WEBKIT
3.0-PRE-CLANG-FORMAT-WEBKIT
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0.0-NA
openssl-3.*
openssl-3.0.0
openssl-3.0.1
openssl-3.0.10
openssl-3.0.11
openssl-3.0.12
openssl-3.0.13
openssl-3.0.14
openssl-3.0.15
openssl-3.0.16
openssl-3.0.17
openssl-3.0.18
openssl-3.0.19
openssl-3.0.2
openssl-3.0.20
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8
openssl-3.0.9
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.4.5
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-4.*
openssl-4.0.0

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_finish"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "signature_version": "v1",
        "digest": {
            "function_hash": "158721614370078287808712549016299069559",
            "length": 238.0
        },
        "id": "CVE-2026-45446-04f7553f"
    },
    {
        "id": "CVE-2026-45446-0fcc8e2b",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "262064497534705031135146164489043756153",
                "230013526533713377218657287063374662703",
                "158563408873972888139115933632177001000",
                "327762206674913726281022521178201049040",
                "104238497038828376753385743213015286004",
                "115377845688502498444142054515740837498",
                "224738083693485546979487470058074563758",
                "265015595600793263192904302541748964703"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2026-45446-150e803c",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_finish"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "158721614370078287808712549016299069559",
            "length": 238.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c",
            "function": "aes_siv_set_ctx_params"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3",
        "signature_version": "v1",
        "digest": {
            "function_hash": "316424318485998315098395040544833807455",
            "length": 959.0
        },
        "id": "CVE-2026-45446-26609ad4"
    },
    {
        "digest": {
            "line_hashes": [
                "41559210531235908934995356425002807404",
                "64181360022466108977394244330689605596",
                "102085589594250503101082132431795653602",
                "260213848374380428210995098539707683059",
                "310955169047574208718758946789810418537",
                "1695193999197184933712918995160890232"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "test/evp_extra_test.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "id": "CVE-2026-45446-285c7fe7",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "test/evp_extra_test.c",
            "function": "setup_tests"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3",
        "digest": {
            "function_hash": "70331810241619730430854658083698746020",
            "length": 5063.0
        },
        "id": "CVE-2026-45446-52813ef8",
        "signature_type": "Function"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "256244367260513002227402622957828642642",
                "212636249187500290863507838490256186905",
                "321384449847189605462840297229106481980",
                "206278951665628331729886047077054652114",
                "104238497038828376753385743213015286004",
                "115377845688502498444142054515740837498",
                "224738083693485546979487470058074563758",
                "328427421784940902274309608810635268962"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-5e469564"
    },
    {
        "id": "CVE-2026-45446-73ea345d",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_finish"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "158721614370078287808712549016299069559",
            "length": 238.0
        }
    },
    {
        "digest": {
            "function_hash": "65382824141024350258741396830185715116",
            "length": 1694.0
        },
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_initkey"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "id": "CVE-2026-45446-7974dd33",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_initkey"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "signature_version": "v1",
        "digest": {
            "function_hash": "65382824141024350258741396830185715116",
            "length": 1694.0
        },
        "id": "CVE-2026-45446-93573b7e"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "test/evp_extra_test.c",
            "function": "setup_tests"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "signature_version": "v1",
        "digest": {
            "function_hash": "242769486546032560880554478976558526474",
            "length": 5737.0
        },
        "id": "CVE-2026-45446-9a85dce2"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c",
            "function": "aes_siv_set_ctx_params"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "signature_version": "v1",
        "digest": {
            "function_hash": "1930129638149782085989213691777352792",
            "length": 964.0
        },
        "id": "CVE-2026-45446-ac6a0649"
    },
    {
        "digest": {
            "function_hash": "52919672183310863610406723058990263490",
            "length": 5669.0
        },
        "target": {
            "file": "test/evp_extra_test.c",
            "function": "setup_tests"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "id": "CVE-2026-45446-b3299e22",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "65382824141024350258741396830185715116",
            "length": 1694.0
        },
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_initkey"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "id": "CVE-2026-45446-b47ae377",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "test/evp_extra_test.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "41559210531235908934995356425002807404",
                "64181360022466108977394244330689605596",
                "102085589594250503101082132431795653602",
                "260213848374380428210995098539707683059",
                "310955169047574208718758946789810418537",
                "1695193999197184933712918995160890232"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-b80a4804"
    },
    {
        "digest": {
            "line_hashes": [
                "138563845722090730816043980375055428731",
                "335713466709260741280912996113348682625",
                "47316338793816263244834689309555009316",
                "263046424645169129112266201802679782836",
                "90737495378119868315641999474360558253",
                "261333399382468110968035410254416600282",
                "184211945248227943217562575758663239136",
                "95221615782895089733843227878161524844",
                "17824044026632567300367109993096829704",
                "76958458280089471794741161622089962880",
                "261870241725191026899722355795723272516",
                "116367385204886141298448350741440666779",
                "118209368312553788850538322033782884504",
                "179941398186058827710790011347351726698",
                "75599106318376123376754513452439772915",
                "117968802601200594056188999258794231679",
                "133322593691232724536354656132457006091",
                "105724398817096365698223886845374158540"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "id": "CVE-2026-45446-c37d237a",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "test/evp_extra_test.c",
            "function": "setup_tests"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68",
        "signature_version": "v1",
        "digest": {
            "function_hash": "242769486546032560880554478976558526474",
            "length": 5737.0
        },
        "id": "CVE-2026-45446-d06ca4e0"
    },
    {
        "id": "CVE-2026-45446-d64e3ad4",
        "target": {
            "file": "test/evp_extra_test.c",
            "function": "setup_tests"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "331949961630713611980908173357239942147",
            "length": 5404.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c",
            "function": "aes_siv_set_ctx_params"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "signature_version": "v1",
        "digest": {
            "function_hash": "306299865402112353958482767359454929794",
            "length": 866.0
        },
        "id": "CVE-2026-45446-da866ae5"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "test/evp_extra_test.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "41559210531235908934995356425002807404",
                "64181360022466108977394244330689605596",
                "102085589594250503101082132431795653602",
                "260213848374380428210995098539707683059",
                "310955169047574208718758946789810418537",
                "1695193999197184933712918995160890232"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-db961018"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_finish"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "signature_version": "v1",
        "digest": {
            "function_hash": "158721614370078287808712549016299069559",
            "length": 238.0
        },
        "id": "CVE-2026-45446-df296dab"
    },
    {
        "id": "CVE-2026-45446-e10f29ff",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "138563845722090730816043980375055428731",
                "335713466709260741280912996113348682625",
                "47316338793816263244834689309555009316",
                "263046424645169129112266201802679782836",
                "90737495378119868315641999474360558253",
                "261333399382468110968035410254416600282",
                "184211945248227943217562575758663239136",
                "95221615782895089733843227878161524844",
                "17824044026632567300367109993096829704",
                "76958458280089471794741161622089962880",
                "261870241725191026899722355795723272516",
                "116367385204886141298448350741440666779",
                "118209368312553788850538322033782884504",
                "179941398186058827710790011347351726698",
                "75599106318376123376754513452439772915",
                "117968802601200594056188999258794231679",
                "133322593691232724536354656132457006091",
                "105724398817096365698223886845374158540"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c",
            "function": "aes_gcm_siv_initkey"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "signature_version": "v1",
        "digest": {
            "function_hash": "65382824141024350258741396830185715116",
            "length": 1694.0
        },
        "id": "CVE-2026-45446-e204b738"
    },
    {
        "digest": {
            "line_hashes": [
                "256244367260513002227402622957828642642",
                "86680369800201187981417876115917769283",
                "338876936185351730287718329047251254126",
                "98674426125709029100816779836270002878",
                "104238497038828376753385743213015286004",
                "115377845688502498444142054515740837498",
                "224738083693485546979487470058074563758",
                "328427421784940902274309608810635268962"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "id": "CVE-2026-45446-e238ab58",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c",
            "function": "aes_siv_set_ctx_params"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "signature_version": "v1",
        "digest": {
            "function_hash": "1930129638149782085989213691777352792",
            "length": 964.0
        },
        "id": "CVE-2026-45446-e3ed8dd4"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c",
            "function": "aes_siv_set_ctx_params"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "signature_version": "v1",
        "digest": {
            "function_hash": "316424318485998315098395040544833807455",
            "length": 959.0
        },
        "id": "CVE-2026-45446-e6e1fe54"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "138563845722090730816043980375055428731",
                "335713466709260741280912996113348682625",
                "47316338793816263244834689309555009316",
                "263046424645169129112266201802679782836",
                "90737495378119868315641999474360558253",
                "261333399382468110968035410254416600282",
                "184211945248227943217562575758663239136",
                "95221615782895089733843227878161524844",
                "17824044026632567300367109993096829704",
                "76958458280089471794741161622089962880",
                "261870241725191026899722355795723272516",
                "116367385204886141298448350741440666779",
                "118209368312553788850538322033782884504",
                "179941398186058827710790011347351726698",
                "75599106318376123376754513452439772915",
                "117968802601200594056188999258794231679",
                "133322593691232724536354656132457006091",
                "105724398817096365698223886845374158540"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-e97e9ad0"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "test/evp_extra_test.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "41559210531235908934995356425002807404",
                "64181360022466108977394244330689605596",
                "102085589594250503101082132431795653602",
                "260213848374380428210995098539707683059",
                "310955169047574208718758946789810418537",
                "320053811960745147465532781298145188708"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-eec09eb0"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "256244367260513002227402622957828642642",
                "86680369800201187981417876115917769283",
                "338876936185351730287718329047251254126",
                "98674426125709029100816779836270002878",
                "104238497038828376753385743213015286004",
                "115377845688502498444142054515740837498",
                "224738083693485546979487470058074563758",
                "328427421784940902274309608810635268962"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-f0f8e359"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_siv.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85",
        "digest": {
            "line_hashes": [
                "256244367260513002227402622957828642642",
                "212636249187500290863507838490256186905",
                "321384449847189605462840297229106481980",
                "206278951665628331729886047077054652114",
                "104238497038828376753385743213015286004",
                "115377845688502498444142054515740837498",
                "224738083693485546979487470058074563758",
                "328427421784940902274309608810635268962"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-f1e5c2c2",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "test/evp_extra_test.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3",
        "digest": {
            "line_hashes": [
                "41559210531235908934995356425002807404",
                "64181360022466108977394244330689605596",
                "102085589594250503101082132431795653602",
                "260213848374380428210995098539707683059",
                "310955169047574208718758946789810418537",
                "320053811960745147465532781298145188708"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-f80ca38a",
        "signature_type": "Line"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "138563845722090730816043980375055428731",
                "335713466709260741280912996113348682625",
                "47316338793816263244834689309555009316",
                "263046424645169129112266201802679782836",
                "90737495378119868315641999474360558253",
                "261333399382468110968035410254416600282",
                "184211945248227943217562575758663239136",
                "95221615782895089733843227878161524844",
                "17824044026632567300367109993096829704",
                "76958458280089471794741161622089962880",
                "261870241725191026899722355795723272516",
                "116367385204886141298448350741440666779",
                "118209368312553788850538322033782884504",
                "179941398186058827710790011347351726698",
                "75599106318376123376754513452439772915",
                "117968802601200594056188999258794231679",
                "133322593691232724536354656132457006091",
                "105724398817096365698223886845374158540"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45446-ffd4af8a"
    }
]
vanir_signatures_modified 
"2026-07-14T17:01:45Z"
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45446.json"