CVE-2026-6331 describes a weakness in the EVP_DigestVerifyFinal function's HMAC verification process. The vulnerability arises because the verification logic only ensured the signature length was not greater than the MAC length, allowing zero-length or truncated tags to be accepted as valid. This could enable an attacker to forge a zero-length HMAC tag that passes verification. The fix enforces that the supplied tag length must exactly equal the MAC length and disallows zero-length MACs, thereby preventing acceptance of forged short or empty tags.

The vulnerability could allow an attacker to bypass HMAC verification by presenting a zero-length or truncated tag that is incorrectly accepted as valid. This undermines the integrity verification provided by HMAC, potentially allowing unauthorized data to be accepted as authentic. However, the severity is rated low, indicating limited impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves enforcing exact tag length matching and rejecting zero-length tags in the HMAC verification process. Until an official fix is available, users should monitor vendor communications for updates.