CVE-2026-45445

A vulnerability exists in OpenSSL where applications using the EVP_Cipher() one-shot interface with an AES-OCB context will have their application-supplied initialisation vector (IV) silently discarded. Because the one-shot handler fails to flush the IV, every message encrypted under the same key...

CVE-2025-11931

Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wcXChaCha20Poly1305Decrypt which is not used with TLS connections, only from direct calls from an application...

PT-2025-47819

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-11931 Description An integer underflow can lead to out-of-bounds access during decryption using XChaCha20-Poly1305. This occurs specifically when calling the wc XChaCha20Poly1305 Decrypt function, which is utilized by...