Incorrect Tag Processing for Empty Messages in OpenSSL AES-GCM-SIV and AES-SIV

OpenSSL's provider implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) incorrectly handle authentication when decrypting messages that contain Additional Authenticated Data (AAD) but an empty ciphertext. The flaw occurs because the expected authentication tag is only recomputed when the decryption path processes non-empty ciphertext data. If an application supplies AAD and then calls EVP_DecryptFinal_ex() without first invoking the ciphertext update path, as can occur when the received ciphertext length is zero, the internal expected tag remains its all-zero initial value instead of being derived from the AAD. As a result, authentication can incorrectly succeed for forged empty-ciphertext messages. For AES-GCM-SIV, an attacker can send arbitrary AAD, empty ciphertext, and an all-zero tag and pass authentication under any unknown key in a single attempt. For AES-SIV, exploitation additionally requires the application to reuse the decryption context without resetting the key. AES-SIV has been present since OpenSSL 3.0 and AES-GCM-SIV since OpenSSL 3.2. OpenSSL's own built-in protocols, including TLS, CMS, PKCS7, HPKE, and QUIC, do not use these modes, so exposure is limited to applications implementing their own protocols via the EVP interface.