Skip to content
OpenAdvisories
Medium ALSA-2026:19218 1 CVE

Moderate: openssl security update

Published May 19, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 9 openssl 1:3.5.5-2.el9_8
AlmaLinux · 9 openssl-devel 1:3.5.5-2.el9_8
AlmaLinux · 9 openssl-libs 1:3.5.5-2.el9_8
AlmaLinux · 9 openssl-perl 1:3.5.5-2.el9_8

Vulnerabilities 1

  • High 7.5
    CVE-2026-31790

    Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-31790
  • report
    https://bugzilla.redhat.com/2451094
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-19218.html