JLSEC-2026-230

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-230.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-230.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2026-230
Upstream
  • EUVD-2022-6221
Published
2026-04-27T18:33:55.942Z
Modified
2026-04-27T20:32:29.777596990Z
Summary
AES OCB fails to encrypt some bytes
Details

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

Database specific 
{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2097",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-2097",
            "id": "CVE-2022-2097",
            "database_specific": {
                "status": "Modified"
            },
            "imported": "2026-04-27T16:32:34.553Z",
            "modified": "2024-11-21T07:00:18.757Z",
            "published": "2022-07-05T11:15:08.340Z"
        },
        {
            "html_url": "https://github.com/advisories/GHSA-3wx7-46ch-7rq2",
            "url": "https://api.github.com/advisories/GHSA-3wx7-46ch-7rq2",
            "id": "GHSA-3wx7-46ch-7rq2",
            "imported": "2026-04-27T16:34:08.944Z",
            "modified": "2024-06-24T21:24:19Z",
            "published": "2022-07-06T19:57:19Z"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6221",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2022-6221",
            "id": "EUVD-2022-6221",
            "imported": "2026-04-27T16:33:21.118Z",
            "modified": "2024-09-17T01:06:49Z",
            "published": "2022-07-05T10:30:13Z"
        }
    ]
}
References
Credits

Affected packages

Julia / OpenSSL_jll

Package

Name
OpenSSL_jll
Purl
pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.17+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-230.json"

Julia / Openresty_jll

Package

Name
Openresty_jll
Purl
pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type
SEMVER
Events
Introduced
1.19.9+0
Fixed
1.27.1+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-230.json"