{"id":"CVE-2026-45446","summary":"Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes","details":"Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV\n(RFC 8452) mishandle the authentication of AAD (Additional Authenticated\nData) with an empty ciphertext allowing a forgery of such messages.\n\nImpact summary: An attacker can forge empty messages with arbitrary AAD\nto the victim's application using these ciphers.\n\nAES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD\nmodes: they accept a key, nonce, optional AAD (bytes that are authenticated\nbut not encrypted), and plaintext, and produces ciphertext plus a 16-byte\ntag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only\nif the tag is verified succesfully.\n\nIn OpenSSL's provider implementation of these ciphers, the expected tag is\ncomputed only when decryption function is invoked with non-empty data.\nIf the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without\ninvocation of the ciphertext update, which can happen when the received\nciphertext length is zero, the tag is never recalculated and still holds its\nall-zeros value.\n\nWhen AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty\nciphertext, and all-zeros tag passes authentication under any key they do not\nknow, single-shot. When AES-SIV is used, for mounting the attack it's\nnecessary for the application to reuse the decryption context without\nresetting the key.\n\nAES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since\nOpenSSL 3.2.\n\nNo protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support\neither AES-GCM-SIV or AES-SIV. To mount an attack, the applications must\nimplement their own protocol and use the EVP interface. Also they must skip the\nciphertext update when a message with an empty ciphertext arrives.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as these algorithms are not FIPS approved and the affected code is\noutside the OpenSSL FIPS module boundary.","modified":"2026-07-26T03:40:49.636838Z","published":"2026-06-09T16:03:32.120Z","related":["ALSA-2026:25237","ALSA-2026:25239","CGA-3qcp-c7r3-629f","SUSE-SU-2026:22100-1","SUSE-SU-2026:22132-1","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","SUSE-SU-2026:2393-1","SUSE-SU-2026:2397-1","SUSE-SU-2026:2598-1","SUSE-SU-2026:2648-1","openSUSE-SU-2026:11023-1","openSUSE-SU-2026:21005-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-325"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45446.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45446.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45446"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260609.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"89cd17a031e022211684eb7eb41190cf1910f9fa"},{"fixed":"51ea949dc1436e865935b47874b21a3bb31a102e"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"c5ea1cc227fd60afae8ac4b9438690bbe4888f79"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"8cf17aaeb4599f8af87fefd810b5b5fee90fe69e"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"fixed":"aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f"},{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"fixed":"25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc"},{"fixed":"71e2a5d263518cf5866043bd60ee4994d59e53a3"},{"fixed":"7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85"},{"fixed":"daca0f48e4a69a2892a62262bad59e62a8a76598"},{"fixed":"eec5e9bf0d867333b8495e456f5235d225798a68"}],"database_specific":{"cpe":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.0.21"},{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.7"},{"introduced":"3.6.0"},{"fixed":"3.6.3"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["4.0.0-NA","openssl-4.0.0","openssl-3.0.20","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.0.19","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.0-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.0-PRE-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.0.18","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.0.17","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.0.16","openssl-3.4.1","openssl-3.4.0","openssl-3.0.15","openssl-3.0.14","openssl-3.0.13","openssl-3.0.12","openssl-3.0.11","openssl-3.0.10","openssl-3.0.9","openssl-3.0.8","openssl-3.0.7","openssl-3.0.6","openssl-3.0.5","openssl-3.0.4","openssl-3.0.3","openssl-3.0.2","openssl-3.0.1","openssl-3.0.0"],"database_specific":{"vanir_signatures_modified":"2026-07-26T03:40:49Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"},"deprecated":false,"digest":{"function_hash":"158721614370078287808712549016299069559","length":238},"id":"CVE-2026-45446-04f7553f","signature_type":"Function"},{"target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c"},"deprecated":false,"digest":{"line_hashes":["262064497534705031135146164489043756153","230013526533713377218657287063374662703","158563408873972888139115933632177001000","327762206674913726281022521178201049040","104238497038828376753385743213015286004","115377845688502498444142054515740837498","224738083693485546979487470058074563758","265015595600793263192904302541748964703"],"threshold":0.9},"id":"CVE-2026-45446-0fcc8e2b","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"},"deprecated":false,"digest":{"length":238,"function_hash":"158721614370078287808712549016299069559"},"id":"CVE-2026-45446-150e803c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c","function":"aes_siv_set_ctx_params"},"deprecated":false,"digest":{"function_hash":"316424318485998315098395040544833807455","length":959},"id":"CVE-2026-45446-26609ad4"},{"id":"CVE-2026-45446-285c7fe7","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc","target":{"file":"test/evp_extra_test.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["41559210531235908934995356425002807404","64181360022466108977394244330689605596","102085589594250503101082132431795653602","260213848374380428210995098539707683059","310955169047574208718758946789810418537","1695193999197184933712918995160890232"]}},{"target":{"file":"test/evp_extra_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"70331810241619730430854658083698746020","length":5063},"id":"CVE-2026-45446-52813ef8","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3"},{"source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c"},"deprecated":false,"digest":{"line_hashes":["256244367260513002227402622957828642642","212636249187500290863507838490256186905","321384449847189605462840297229106481980","206278951665628331729886047077054652114","104238497038828376753385743213015286004","115377845688502498444142054515740837498","224738083693485546979487470058074563758","328427421784940902274309608810635268962"],"threshold":0.9},"id":"CVE-2026-45446-5e469564","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"158721614370078287808712549016299069559","length":238},"id":"CVE-2026-45446-73ea345d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"}},{"target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_initkey"},"deprecated":false,"digest":{"length":1694,"function_hash":"65382824141024350258741396830185715116"},"id":"CVE-2026-45446-7974dd33","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc"},{"deprecated":false,"digest":{"function_hash":"65382824141024350258741396830185715116","length":1694},"id":"CVE-2026-45446-93573b7e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_initkey"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"file":"test/evp_extra_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"242769486546032560880554478976558526474","length":5737},"id":"CVE-2026-45446-9a85dce2","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"1930129638149782085989213691777352792","length":964},"id":"CVE-2026-45446-ac6a0649","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c","function":"aes_siv_set_ctx_params"}},{"source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc","target":{"file":"test/evp_extra_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"52919672183310863610406723058990263490","length":5669},"id":"CVE-2026-45446-b3299e22","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_initkey"},"deprecated":false,"digest":{"function_hash":"65382824141024350258741396830185715116","length":1694},"id":"CVE-2026-45446-b47ae377","signature_type":"Function"},{"source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"test/evp_extra_test.c"},"deprecated":false,"digest":{"line_hashes":["41559210531235908934995356425002807404","64181360022466108977394244330689605596","102085589594250503101082132431795653602","260213848374380428210995098539707683059","310955169047574208718758946789810418537","1695193999197184933712918995160890232"],"threshold":0.9},"id":"CVE-2026-45446-b80a4804","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["138563845722090730816043980375055428731","335713466709260741280912996113348682625","47316338793816263244834689309555009316","263046424645169129112266201802679782836","90737495378119868315641999474360558253","261333399382468110968035410254416600282","184211945248227943217562575758663239136","95221615782895089733843227878161524844","17824044026632567300367109993096829704","76958458280089471794741161622089962880","261870241725191026899722355795723272516","116367385204886141298448350741440666779","118209368312553788850538322033782884504","179941398186058827710790011347351726698","75599106318376123376754513452439772915","117968802601200594056188999258794231679","133322593691232724536354656132457006091","105724398817096365698223886845374158540"]},"id":"CVE-2026-45446-c37d237a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68","target":{"file":"test/evp_extra_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"242769486546032560880554478976558526474","length":5737},"id":"CVE-2026-45446-d06ca4e0"},{"target":{"file":"test/evp_extra_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"331949961630713611980908173357239942147","length":5404},"id":"CVE-2026-45446-d64e3ad4","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598"},{"id":"CVE-2026-45446-da866ae5","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c","function":"aes_siv_set_ctx_params"},"deprecated":false,"digest":{"function_hash":"306299865402112353958482767359454929794","length":866}},{"id":"CVE-2026-45446-db961018","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"file":"test/evp_extra_test.c"},"deprecated":false,"digest":{"line_hashes":["41559210531235908934995356425002807404","64181360022466108977394244330689605596","102085589594250503101082132431795653602","260213848374380428210995098539707683059","310955169047574208718758946789810418537","1695193999197184933712918995160890232"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"158721614370078287808712549016299069559","length":238},"id":"CVE-2026-45446-df296dab","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_finish"}},{"id":"CVE-2026-45446-e10f29ff","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"},"deprecated":false,"digest":{"line_hashes":["138563845722090730816043980375055428731","335713466709260741280912996113348682625","47316338793816263244834689309555009316","263046424645169129112266201802679782836","90737495378119868315641999474360558253","261333399382468110968035410254416600282","184211945248227943217562575758663239136","95221615782895089733843227878161524844","17824044026632567300367109993096829704","76958458280089471794741161622089962880","261870241725191026899722355795723272516","116367385204886141298448350741440666779","118209368312553788850538322033782884504","179941398186058827710790011347351726698","75599106318376123376754513452439772915","117968802601200594056188999258794231679","133322593691232724536354656132457006091","105724398817096365698223886845374158540"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c","function":"aes_gcm_siv_initkey"},"deprecated":false,"digest":{"length":1694,"function_hash":"65382824141024350258741396830185715116"},"id":"CVE-2026-45446-e204b738"},{"deprecated":false,"digest":{"line_hashes":["256244367260513002227402622957828642642","86680369800201187981417876115917769283","338876936185351730287718329047251254126","98674426125709029100816779836270002878","104238497038828376753385743213015286004","115377845688502498444142054515740837498","224738083693485546979487470058074563758","328427421784940902274309608810635268962"],"threshold":0.9},"id":"CVE-2026-45446-e238ab58","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c"}},{"digest":{"function_hash":"1930129638149782085989213691777352792","length":964},"id":"CVE-2026-45446-e3ed8dd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"function":"aes_siv_set_ctx_params","file":"providers/implementations/ciphers/cipher_aes_siv.c"},"deprecated":false},{"digest":{"function_hash":"316424318485998315098395040544833807455","length":959},"id":"CVE-2026-45446-e6e1fe54","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c","function":"aes_siv_set_ctx_params"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"},"deprecated":false,"digest":{"line_hashes":["138563845722090730816043980375055428731","335713466709260741280912996113348682625","47316338793816263244834689309555009316","263046424645169129112266201802679782836","90737495378119868315641999474360558253","261333399382468110968035410254416600282","184211945248227943217562575758663239136","95221615782895089733843227878161524844","17824044026632567300367109993096829704","76958458280089471794741161622089962880","261870241725191026899722355795723272516","116367385204886141298448350741440666779","118209368312553788850538322033782884504","179941398186058827710790011347351726698","75599106318376123376754513452439772915","117968802601200594056188999258794231679","133322593691232724536354656132457006091","105724398817096365698223886845374158540"],"threshold":0.9},"id":"CVE-2026-45446-e97e9ad0"},{"target":{"file":"test/evp_extra_test.c"},"deprecated":false,"digest":{"line_hashes":["41559210531235908934995356425002807404","64181360022466108977394244330689605596","102085589594250503101082132431795653602","260213848374380428210995098539707683059","310955169047574208718758946789810418537","320053811960745147465532781298145188708"],"threshold":0.9},"id":"CVE-2026-45446-eec09eb0","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598"},{"id":"CVE-2026-45446-f0f8e359","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c"},"deprecated":false,"digest":{"line_hashes":["256244367260513002227402622957828642642","86680369800201187981417876115917769283","338876936185351730287718329047251254126","98674426125709029100816779836270002878","104238497038828376753385743213015286004","115377845688502498444142054515740837498","224738083693485546979487470058074563758","328427421784940902274309608810635268962"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["256244367260513002227402622957828642642","212636249187500290863507838490256186905","321384449847189605462840297229106481980","206278951665628331729886047077054652114","104238497038828376753385743213015286004","115377845688502498444142054515740837498","224738083693485546979487470058074563758","328427421784940902274309608810635268962"],"threshold":0.9},"id":"CVE-2026-45446-f1e5c2c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85","target":{"file":"providers/implementations/ciphers/cipher_aes_siv.c"}},{"deprecated":false,"digest":{"line_hashes":["41559210531235908934995356425002807404","64181360022466108977394244330689605596","102085589594250503101082132431795653602","260213848374380428210995098539707683059","310955169047574208718758946789810418537","320053811960745147465532781298145188708"],"threshold":0.9},"id":"CVE-2026-45446-f80ca38a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3","target":{"file":"test/evp_extra_test.c"}},{"id":"CVE-2026-45446-ffd4af8a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc","target":{"file":"providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c"},"deprecated":false,"digest":{"line_hashes":["138563845722090730816043980375055428731","335713466709260741280912996113348682625","47316338793816263244834689309555009316","263046424645169129112266201802679782836","90737495378119868315641999474360558253","261333399382468110968035410254416600282","184211945248227943217562575758663239136","95221615782895089733843227878161524844","17824044026632567300367109993096829704","76958458280089471794741161622089962880","261870241725191026899722355795723272516","116367385204886141298448350741440666779","118209368312553788850538322033782884504","179941398186058827710790011347351726698","75599106318376123376754513452439772915","117968802601200594056188999258794231679","133322593691232724536354656132457006091","105724398817096365698223886845374158540"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45446.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}