CVE-2026-75803: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-vr27-9w4v-hjw2
Share
CVSS 9.1
CWE-354
Published
Advisory Summary

CVE-2026-75803 is a CRITICAL (CVSS 9.1) security vulnerability vulnerability (CWE-354: Improper Validation of Integrity Check Value) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product does not validate or incorrectly validates the integrity check values or "checksums" of a message. this may prevent it from detecting if the data has been modified or corrupted in transmission.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-75803 at a Glance

CVE Identifier CVE-2026-75803
GHSA Identifier GHSA-vr27-9w4v-hjw2
Severity CRITICAL
CVSS v3.1 Base Score 9.1
CWE Classification CWE-354: Improper Validation of Integrity Check Value
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-75803

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-75803, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-354: Improper Validation of Integrity Check Value, where the product does not validate or incorrectly validates the integrity check values or "checksums" of a message. this may prevent it from detecting if the data has been modified or corrupted in transmission. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

References

NVD — CVE-2026-75803 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75803
Security Fix Commit FIX COMMIT
https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42
Security Fix Commit FIX COMMIT
https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b
Security Fix Commit FIX COMMIT
https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a
Security Fix Commit FIX COMMIT
https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34
Security Fix Commit FIX COMMIT
https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9
openssl-library.org/news/secadv/2026082... WEB
https://openssl-library.org/news/secadv/20260825.txt

Frequently Asked Questions

What is CVE-2026-75803?
CVE-2026-75803 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-354: Improper Validation of Integrity Check Value.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-75803?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-75803?
CVE-2026-75803 has a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-75803?
CVE-2026-75803 is classified under CWE-354: Improper Validation of Integrity Check Value (The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.).
How can I check Maven dependencies for CVE-2026-75803?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vr27-9w4v-hjw2",
  "modified" : "2026-09-01T21:31:22Z",
  "published" : "2026-08-25T15:32:59Z",
  "aliases" : [ "CVE-2026-75803" ],
  "details" : "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-75803"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9"
  }, {
    "type" : "WEB",
    "url" : "https://openssl-library.org/news/secadv/20260825.txt"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-354" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-25T13:19:29Z"
  }
}