Skip to content
OpenAdvisories
Medium ELSA-2026-38503 1 CVE

Moderate: openssl security update (Oracle Linux 8)

Published Jul 13, 2026 · Updated Jul 13, 2026

Ecosystem: Oracle Linux

Summary

[1:1.1.1k-17]
- Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Resolves: RHEL-165783

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 8 openssl 1:1.1.1k-17.el8_6
Oracle Linux · 8 openssl-devel 1:1.1.1k-17.el8_6
Oracle Linux · 8 openssl-libs 1:1.1.1k-17.el8_6
Oracle Linux · 8 openssl-perl 1:1.1.1k-17.el8_6

Vulnerabilities 1

  • High 7.5
    CVE-2026-28390

    Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi