CVE-2025-69418

Aliases:DEBIAN-CVE-2025-69418UBUNTU-CVE-2025-69418ALPINE-CVE-2025-69418CGA-29g5-v3c6-hqjpCGA-5hm2-rcr7-5h58CGA-74vw-p27x-j6mfCGA-77r9-j2hp-27rhCGA-7c4g-962c-fmjfCGA-7wr3-vx8v-c4h2CGA-8h4w-jq5c-853cCGA-9rx7-pf7j-hq43CGA-qhm4-h3f9-9h7vCGA-r977-4477-4r8pCGA-wm9p-95p7-7xrwCGA-xpjr-mq86-q6wv
Advisory lineage Upstream: 0 Downstream: 26
Modified
Published: 27 Jan 2026, 16:01
Last modified:12 May 2026, 12:08

Vulnerability Summary

Overall Risk (default)
low
16/100
CVSS Score
4 MEDIUM
v3.1 (cve.org)
EPSS Score
0.12% LOW
0% probability +0.11%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Jan 2026, 16:01
Published
Vulnerability first disclosed
12 May 2026, 12:08
Last Modified
Vulnerability information updated

Description

Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.12%• Percentile: 2%

Techniques & Countermeasures

  • CWE-325•Missing Cryptographic Step

    The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Affected Systems

  • alpine•openssl

    ≥ 1.1.1, < 3.0.19-r0 | ≥ 1.1.1, < 3.3.6-r0 | ≥ 1.1.1, < 3.3.6-r0 | ≥ 1.1.1, < 3.5.5-r0 | ≥ 1.1.1, < 3.5.5-r0 | ≥ 1.1.1, < 3.5.5-r0

  • chainguard•libcrypto3-2.34

    < 3.6.1-r0

  • chainguard•openssl

    < 3.6.1-r0

  • chainguard•openssl-provider-fips

    < 0

  • chainguard•openssl-provider-fips-3.1.2

    < 0

  • chainguard•openssl-provider-fips-3.4.0

    < 0

  • chainguard•openssl-provider-fips-3.6.0

    < 0

  • wolfi•openssl

    < 3.6.1-r0

  • debian•openssl

    < 1.1.1w-0+deb11u5 | < 3.0.18-1~deb12u2 | < 3.5.4-1~deb13u2 | < 3.5.5-1

  • ubuntu•edk2

    all | all | all | all | all | all

  • ubuntu•edk2-hwe

    all

  • ubuntu•nodejs

    all

  • ubuntu•openssl

    < 1.1.1-1ubuntu2.1~18.04.23+esm7 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.7 | all | < 1.1.1f-1ubuntu2.24+esm2 | < 1.1.1f-1ubuntu2.fips.24.2 | < 3.0.2-0ubuntu1.21 | < 3.0.2-0ubuntu1.21+Fips1 | < 3.0.13-0ubuntu3.7 | < 3.5.3-1ubuntu3 | < 3.5.5-1ubuntu1

  • ubuntu•openssl-fips

    all | < 3.0.13-0ubuntu3.12+Fips1

  • openssl•openssl

    ≥ 1.1.1, < 1.1.1ze | ≥ 3.0.0, < 3.0.19 | ≥ 3.3.0, < 3.3.6 | ≥ 3.4.0, < 3.4.4 | ≥ 3.5.0, < 3.5.5 | ≥ 3.6.0, < 3.6.1

References (15)