CVE-2026-32313: Php Openssl Decrypt Unvalidated Tag Lengthcve-2026-32313-php-openssl-decrypt-unvalidated-tag-length
The authentication tag for AES-GCM decryption is extracted using `substr` but its length is not validated. If an attacker provides a short payload, `substr` may return a truncated tag which `openssl_decrypt` accepts, allowing brute-force attacks to recover the GHASH key and forge ciphertexts. Verify the tag length using `strlen` before passing it to `openssl
