CVE-2026-75803 in OpenSSL affects the handling of empty ciphertext under ChaCha20-Poly1305 and AES-OCB. When a zero-length ciphertext is decrypted through EVP_Cipher(), the AEAD tag check is skipped, which the weakness classification records as CWE-354, improper validation of integrity check value. NVD scores it 9.1. The listing that surfaced it describes the affected component as part of Oracle Database, which is a reminder that OpenSSL arrives inside other products.
That description also explains why measurement is difficult in an unusual way. Almost everything an internet scanner can observe about TLS is negotiated at the protocol layer, and the vulnerable code path lives below it.
ZoomEye queries for this article were not completed because the API returned HTTP 502 during the research window. No counts are given.

What a TLS scan can and cannot establish

A scan can establish the protocol versions a server accepts, the cipher suites it selects, the certificate chain, and the server implementation string when the server volunteers one.
A scan cannot establish which build of OpenSSL produced those responses. Two servers offering identical cipher suites and protocol versions may run one patched and one unpatched OpenSSL, and the handshake will not distinguish them.
There is a further layer of compression. OpenSSL is a dependency: it sits inside nginx, inside Apache via mod_ssl, inside PostgreSQL, inside appliances, and inside the Oracle Database build referenced in this CVE. The observable layer is the front-end, and the front-end version is the thing a scan reports.
So the honest measurement statement is narrow. A scan can identify servers that negotiate ChaCha20-Poly1305 or AES-OCB, which is a precondition for the affected code path being present in a build that supports them. It cannot confirm the build.

Queries and their meaning

Cipher visibility depends on what the target negotiates in response to the scanner's offer, which is why cipher-based queries have lower recall than version queries:

ssl="TLSv1.3"
ssl.cipher="TLS_CHACHA20_POLY1305_SHA256"
port=443 && ssl="TLSv1.2"

TLS 1.3 mandates TLS_CHACHA20_POLY1305_SHA256 support in practice for most stacks, so a TLS 1.3 query is close to a query for "modern TLS endpoint" rather than for the cipher. That reduces its discriminative value considerably and should be stated whenever such a count is quoted.
AES-OCB is more interesting because it is not a TLS 1.3 mandatory cipher. It appears in TLS 1.3 optionally and is common in specific library configurations. A query for it returns fewer results and a more specific population, though still a population defined by negotiated cipher rather than by library.
Implementation strings are the other angle:

ssl.server="OpenSSL"
http.header.server="nginx"
product="OpenSSL"

ssl.server reflects the value the server puts in its handshake response, and modern deployments frequently strip or omit it. A negative result here has essentially no diagnostic value, which is the opposite of how such results are often reported.

The measurement conclusion that generalises

For library-level vulnerabilities, internet scanning supports an inventory function and not a version-assessment function. The inventory function is real: knowing which of your public endpoints terminate TLS with a stack you do not track is a finding worth acting on.
The version-assessment function belongs to authenticated configuration review, package inventory from the host, or a scan that reads package metadata through an agent.
Reports that present a large TLS endpoint count as exposure to a specific library CVE are making a category error, and the error is common enough that readers should treat such counts with suspicion unless the report states how the build was established.

References

  • NVD entry for CVE-2026-75803, CWE-354, CVSS 9.1, empty ciphertext handling under ChaCha20-Poly1305 and AES-OCB through EVP_Cipher()

  • OpenSSL security advisory covering CVE-2026-75803

  • Oracle Critical Patch Update listing for the affected database component

  • ZoomEye official MCP search syntax reference for ssl, ssl.cipher, ssl.server, port and product