Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Hardened Images 1 hummingbird:1 | openssl3 | 0:3.5.8-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | openssl3-devel | 0:3.5.8-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | openssl3-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | openssl3-libs | 0:3.5.8-0.1.hum1 |
Vulnerabilities 27
-
Critical 9.8
Untrusted Sender DN Used as Format String in CMP Response Validation
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expecte…
-
Critical 9.1
CMS AuthEnvelopedData Processing May Accept Forged Messages
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of …
-
Critical 9.1
AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EV…
-
High 8.8CVE-2026-45447 Public exploit
Heap Use-After-Free in the PKCS7_verify() Function
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When…
-
High 8.1
Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code executi…
-
High 7.5
RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys an…
-
High 7.5
QUIC Server May Trigger Double Free When Processing INITIAL Packet
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial…
-
High 7.5
Heap Buffer Over-read in ASN.1 Content Parsing
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the…
-
High 7.5
Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termin…
-
High 7.5
NULL Pointer Dereference in QUIC Server Initial Packet Handling
Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affe…
-
High 7.5
NULL Dereference in Certificate Verification with OCSP Checking
Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact sum…
-
High 7.5
AES-OCB IV Ignored on EVP_Cipher() Path
Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the sam…
-
High 7.5
Excessive Memory Use Buffering DTLS Records for a Future Epoch
Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpo…
-
High 7.5CVE-2026-63072 Public exploit
Heap Buffer Overflow in CMS Key Unwrapping
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…
-
High 7.5
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A rem…
-
High 7.5
Invalid Pointer Dereference in CMP Server via Crafted protectionAlg
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which i…
-
High 7.5
Out-of-Bounds Read in CMS Password-Based Decryption
Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read m…
-
High 7.4
PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker im…
-
Medium 6.2
Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()
Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfilt…
-
Medium 5.9
Possible NULL Dereference in Password-Based CMS Decryption
Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.…
-
Medium 5.9
NULL Pointer Dereference in CRMF EncryptedValue Decryption
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An a…
-
Medium 5.9
CMP Indefinite Cache Growth of ExtraCerts
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraC…
-
Medium 5.3
Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from …
-
Medium 5.0
Double-free When Checking OCSP Stapled Response
Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an at…
-
Medium 4.8
Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes
Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty m…
-
Low 3.7
Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-sty…
-
Low 3.7
FFC-DH Peer Validation Uses Attacker-Supplied q
Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a fo…
References
-
article
https://images.redhat.com/
-
report
https://access.redhat.com/security/cve/CVE-2026-63074
-
article
https://access.redhat.com/security/updates/classification/
-
report
https://access.redhat.com/security/cve/CVE-2026-63073
-
report
https://access.redhat.com/security/cve/CVE-2026-14457
-
report
https://access.redhat.com/security/cve/CVE-2026-63076
-
report
https://access.redhat.com/security/cve/CVE-2026-63075
-
report
https://access.redhat.com/security/cve/CVE-2026-63072
-
report
https://access.redhat.com/security/cve/CVE-2026-54874
-
report
https://access.redhat.com/security/cve/CVE-2026-18798
-
report
https://access.redhat.com/security/cve/CVE-2026-75803
-
report
https://access.redhat.com/security/cve/CVE-2026-42769
-
report
https://access.redhat.com/security/cve/CVE-2026-42768
-
report
https://access.redhat.com/security/cve/CVE-2026-34180
-
report
https://access.redhat.com/security/cve/CVE-2026-7383
-
report
https://access.redhat.com/security/cve/CVE-2026-45447
-
report
https://access.redhat.com/security/cve/CVE-2026-42766
-
report
https://access.redhat.com/security/cve/CVE-2026-42767
-
report
https://access.redhat.com/security/cve/CVE-2026-34183
-
report
https://access.redhat.com/security/cve/CVE-2026-45445
-
report
https://access.redhat.com/security/cve/CVE-2026-9076
-
report
https://access.redhat.com/security/cve/CVE-2026-42765
-
report
https://access.redhat.com/security/cve/CVE-2026-42771
-
report
https://access.redhat.com/security/cve/CVE-2026-35188
-
report
https://access.redhat.com/security/cve/CVE-2026-34181
-
report
https://access.redhat.com/security/cve/CVE-2026-42770
-
report
https://access.redhat.com/security/cve/CVE-2026-42764
-
report
https://access.redhat.com/security/cve/CVE-2026-45446
-
report
https://access.redhat.com/security/cve/CVE-2026-34182
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59635.json
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2481879
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-7383
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-7383
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2481880
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-9076
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-9076
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2517562
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-14457
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-14457