Skip to content
OpenAdvisories
Medium ELSA-2026-22315 1 CVE

Moderate: compat-openssl10 security update (Oracle Linux 8)

Published Jun 2, 2026 · Updated Jun 2, 2026

Ecosystem: Oracle Linux

Summary

[1.1.0.2o-4.2]
- Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Resolves: RHEL-165754

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 compat-openssl10 1:1.0.2o-4.el8_10.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-28390

    Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi