What is the CVSS score of CVE-2026-45446?

CVE-2026-45446 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45446?

Yes, a patch is available for CVE-2026-45446. Update the affected software to the latest version immediately.

OpenSSL CVE-2026-45446

EUVD-2026-35490 MEDIUM

Missing Cryptographic Step (CWE-325)

2026-06-09

GHSA-7phf-qpm5-q6p3

OpenSSL Information Disclosure

4.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Red Hat

3.7 LOW

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 09, 2026 - 20:28 vuln.today

Analysis Generated

Jun 09, 2026 - 20:28 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

4.8 (MEDIUM)

CVE Published

Jun 09, 2026 - 11:43 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 11:43 nvd

MEDIUM 4.8

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

AnalysisAI

Incorrect authentication tag processing for empty messages in OpenSSL's AES-GCM-SIV and AES-SIV cipher modes enables network-positioned attackers to bypass integrity guarantees on empty ciphertext, yielding limited confidentiality and integrity violations (CVSS 4.8, CWE-325). Affected branches span OpenSSL 3.0.x through 4.0.0, all patched in the OpenSSL 4.0.1 security release dated 2026-06-09. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

AES-GCM-SIV (RFC 8452) and AES-SIV are Authenticated Encryption with Associated Data (AEAD) modes that derive a Synthetic Initialization Vector (SIV) serving as both the IV and the authentication tag, providing nonce-misuse resistance. The root cause is CWE-325 (Missing Required Cryptographic Step): the tag verification step is not correctly executed when the plaintext is empty, creating an edge-case failure in the authentication guarantee that AEAD modes are specifically designed to provide. This is exposed via the OpenSSL EVP cipher API. Affected CPE ranges confirmed by EUVD-2026-35490 cover openssl:openssl versions 3.0.0-3.0.20, 3.4.0-3.4.5, 3.5.0-3.5.6, 3.6.0-3.6.2, and 4.0.0. The CVSS vector AV:N/AC:H reflects that while the flaw is network-reachable, exploitation complexity is high due to the narrow empty-message trigger condition.

RemediationAI

Upgrade to the patched OpenSSL releases published 2026-06-09: OpenSSL 4.0.1 for the 4.0.x branch, 3.6.3 for the 3.6.x branch, 3.5.7 for the 3.5.x branch, 3.4.6 for the 3.4.x branch, and 3.0.21 for the 3.0.x branch. Full vendor advisory is at https://openssl-library.org/news/secadv/20260609.txt and release notes at https://github.com/openssl/openssl/releases/tag/openssl-4.0.1. For Ubuntu, apply the packages detailed in USN-8414-1. Where immediate patching is not feasible, applications can be audited to identify and disable use of AES-GCM-SIV (NID_aes_128_gcm_siv, NID_aes_256_gcm_siv) and AES-SIV cipher modes, substituting AES-GCM or ChaCha20-Poly1305; note this requires application-level code changes and trades away the nonce-misuse-resistance properties that AES-GCM-SIV was selected to provide.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

CVE-2014-3470 MEDIUM This Month

4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before

CVE-2017-3730 HIGH Act Now POC

7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH Act Now

7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-325 – Missing Cryptographic Step

View all

CVE-2021-22946 HIGH POC

7.5

CVE-2026-22863 HIGH POC

7.5

CVE-2026-48480 MEDIUM POC

6.6

CVE-2023-28999 MEDIUM POC

6.4

CVE-2023-28998 MEDIUM POC

6.1

CVE-2026-17666 CRITICAL

9.1

CVE-2021-3680 MEDIUM POC

4.9

CVE-2026-4601 HIGH

8.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2023-4966 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected

CVE-2026-45446 vulnerability details – vuln.today

Back

OpenSSL CVE-2026-45446

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in OpenSSL

Same weakness CWE-325 – Missing Cryptographic Step

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code