CVE-2026-6331

HMAC zero-length tag forgery in EVPDigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated...

CVE-2026-6331

creationtimestamp| type| source ---|---|--- 2026-06-25 21:57:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5gdqrqws2u...