Summary
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
* openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | openssl | 1:1.1.1k-18.el8_6 |
| AlmaLinux · 8 | openssl-devel | 1:1.1.1k-18.el8_6 |
| AlmaLinux · 8 | openssl-libs | 1:1.1.1k-18.el8_6 |
| AlmaLinux · 8 | openssl-perl | 1:1.1.1k-18.el8_6 |
Vulnerabilities 2
-
High 8.2
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspend…
-
High 7.5CVE-2026-63072 Public exploit
Heap Buffer Overflow in CMS Key Unwrapping
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…