Skip to content
OpenAdvisories
Medium ELSA-2026-22313 1 CVE

Moderate: compat-openssl11 security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[1:1.1.1k-5.3]
- Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Resolves: RHEL-165863

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 compat-openssl11 1:1.1.1k-5.el9_8.3

Vulnerabilities 1

  • High 7.5
    CVE-2026-28390

    Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi