OpenSSL: ChaCha20-Poly1305 accepts 16-byte nonces, silently ignoring leading bytes

Impact

OpenSSL 1.1.0 and 1.1.1 allow a ChaCha20-Poly1305 nonce of up to 16 bytes, but only the trailing 12 bytes are significant. An application that sets a longer nonce and varies the leading bytes to obtain uniqueness is in fact reusing the nonce, which breaks both the confidentiality and the integrity guarantees of the AEAD construction; the ignored leading bytes are also outside the integrity tag. OpenSSL's own TLS and internal uses never set such a nonce and are unaffected, so for an operator the exposure is limited to in-house or third-party code on the fleet that calls this cipher directly with a non-default nonce length - for example a custom encryption layer in a storage or telemetry agent. Rated low severity by OpenSSL because of that narrow scope.

Who can reach it

Remote attacker against an application that uses ChaCha20-Poly1305 directly with a nonce length longer than 12 bytes. No OpenSSL-level authentication is involved; stock TLS deployments are not exposed.

What to do

Move to OpenSSL 1.1.1c or 1.1.0k (or a distribution package carrying the backport) and restart services that link it; OpenSSL did not cut emergency releases for this. The durable fix is in application code: use a 12-byte nonce for ChaCha20-Poly1305 and never rely on leading bytes of a longer one for uniqueness.

References

Related entries

• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• OpenSSL: TLS/DTLS clients using raw public keys may not fail the handshake when the server is unauthenticatedCVE-2024-12797 · OpenSSL (RFC7250 raw public key server authentication)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High