CVE-2026-45446

This CVE affects OpenSSL implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452). The root cause is that the expected authentication tag is computed only when the decryption function processes non-empty data; if a caller provides AAD with an empty ciphertext and then calls EVP_DecryptFin...