CVE-2026-6092
NoneCVSS
—
EPSS
0.4%
Published
Jun 25, 2026
CISA due date
—
The record
When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89177 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of… CWE-757
- CVE-2026-59293 Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate… CWE-757
- CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature… CWE-757
- CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently… CWE-757
- CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher… CWE-757
- CVE-2026-54780 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-757
- CVE-2026-54291 pgjdbc is an open source postgresql JDBC Driver. CWE-757
- CVE-2026-1677 Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection… CWE-757