Incorrect Tag Processing for Empty Messages in OpenSSL AES-GCM-SIV and AES-SIV

CVE-2026-45446 is a flaw in OpenSSL's provider implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452). During decryption, authentication of Additional Authenticated Data (AAD) is mishandled when the ciphertext is empty. Specifically, the expected authentication tag is only computed when the decryption path processes non-empty ciphertext data. If an application supplies AAD and then calls EVP_DecryptFinal_ex() without first invoking the ciphertext update path, as can occur when the received ciphertext length is zero, the tag is never recomputed and remains at its all-zero value. As a result, an attacker can cause authentication to succeed for forged empty-ciphertext messages. For AES-GCM-SIV, an attacker can send arbitrary AAD, empty ciphertext, and an all-zero tag and have it accepted under any unknown key in a single shot. For AES-SIV, exploitation requires reuse of the decryption context without resetting the key. AES-SIV has been present since OpenSSL 3.0 and AES-GCM-SIV since OpenSSL 3.2. OpenSSL's own TLS, CMS, PKCS7, HPKE, and QUIC protocol implementations do not use these modes, so exposure is limited to applications implementing their own protocols via the EVP interface.