{"metadata": {"vulnerability": "CVE-2026-88823", "count": 19, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 12}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-10T09:08:26.966Z", "date_only": false, "value": "2026-09-10T09:08:26.966Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-88823", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "vulnerabilities.2.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1496", "record": "CERTFR-2026-AVI-1496", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1496", "record": "CERTFR-2026-AVI-1496", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1496", "record": "CERTFR-2026-AVI-1496", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-10T11:05:35Z", "date_only": false, "value": "2026-11-10T11:05:35.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / openssl", "record": "CVE-2026-88823", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T13:12:32.287Z", "date_only": false, "value": "2026-11-10T13:12:32.287+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T18:15:49.358Z", "date_only": false, "value": "2026-11-10T18:15:49.358Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88823", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T18:15:49.358Z", "date_only": false, "value": "2026-11-10T18:15:49.358Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-88823", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T18:15:49.358Z", "date_only": false, "value": "2026-11-10T18:15:49.358Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openssl", "record": "CVE-2026-88823", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T19:21:34Z", "date_only": false, "value": "2026-11-10T19:21:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MWPV-32CF-MJ9V", "record": "GHSA-MWPV-32CF-MJ9V", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T19:21:34.847Z", "date_only": false, "value": "2026-11-10T19:21:34.847", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88823", "record": "FKIE_CVE-2026-88823", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T21:34:03Z", "date_only": false, "value": "2026-11-10T21:34:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MWPV-32CF-MJ9V", "record": "GHSA-MWPV-32CF-MJ9V", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T21:34:03Z", "date_only": false, "value": "2026-11-10T21:34:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MWPV-32CF-MJ9V", "record": "GHSA-MWPV-32CF-MJ9V", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T22:10:04.727Z", "date_only": false, "value": "2026-11-10T22:10:04.727", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88823", "record": "FKIE_CVE-2026-88823", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T01:27:43.189Z", "date_only": false, "value": "2026-11-11T01:27:43.189996Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117595207284083557", "record": "CVE-2026-88823", "field": "creation_timestamp", "uuid": "b6007e3e-59ba-4638-ab92-9e7a125d461b", "content": "CVE-2026-88823 AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update Issue summary: The AES-GCM-SIV implementation treats a zero-length AdditionalAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,instead of leaving the AAD unchanged. An application that supplies its AAD inseveral fragments, one of which is empty, therefore produces or verifiesmessages whose authentication tag does not cover the AAD supplied beforethe empty fragment.\nImpact summary: Data an application intended to authenticate alongside amessage is silently left unauthenticated. An attacker can forge the AAD of sucha message.\nCWE: CWE-325: Missing Cryptographic Step\nDescription: An application passing AAD in multiple chunks of which some havezero length will have the previous AAD chunks effectively unauthenticated. Also,on context re-initialisation, the AAD was not reset, which meant that any AADaccumulated from the previous context usage were also included in the AAD of thenew message.\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AADwhenever the context is re-initialised with a key or a nonce.A re-initialisation that only changes parameters keeps the AAD.\nFIPS impact: noThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approvedalgorithm and is implemented only in the default provider, outside theOpenSSL FIPS module boundary.\nhttps://www.cve.org/CVERecord?id=CVE-2026-88823https://openssl-library.org/news/secadv/20261110.txthttps://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4#OpenSSL#CVE_2026_88823#bot", "url": "https://infosec.exchange/users/cve/statuses/117595207284083557"}], "metrics": {"as_of": "2026-11-11T03:43:00.342Z", "anchors": {"origin": {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 103380.342037, "hours": 28.716761676944444, "days": 1.1965317365393517, "min_seconds": 103380.342037, "max_seconds": 103380.342037, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T03:43:00.342Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}