Skip to content
OpenAdvisories
High RHSA-2026:1496 3 CVEs

Red Hat Security Advisory: openssl security update

Published Jan 29, 2026 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openssl 1:3.2.2-16.el10_0.6
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openssl-devel 1:3.2.2-16.el10_0.6
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openssl-libs 1:3.2.2-16.el10_0.6
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 openssl-perl 1:3.2.2-16.el10_0.6

Vulnerabilities 3

  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2025-69419 Public exploit

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.1
    CVE-2025-11187 Public exploit

    Improper validation of PBMAC1 parameters in PKCS#12 MAC verification

    Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereferenc…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430375
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430376
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430386
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1496.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-11187
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-11187
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-11187
  • report
    https://access.redhat.com/security/cve/CVE-2025-15467
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-15467
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-15467
  • report
    https://access.redhat.com/security/cve/CVE-2025-69419
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-69419
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-69419