Skip to content
OpenAdvisories
Critical RHSA-2026:67154 9 CVEs

Red Hat Security Advisory: openssl security, bug fix, and enhancement update

Published Sep 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 openssl 1:3.5.8-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 openssl-debuginfo 1:3.5.8-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 openssl-debugsource 1:3.5.8-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 openssl-devel 1:3.5.8-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 openssl-libs 1:3.5.8-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 openssl-libs-debuginfo 1:3.5.8-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 openssl-perl 1:3.5.8-1.el10_2

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-63073

    Untrusted Sender DN Used as Format String in CMP Response Validation

    Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expecte…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-14456

    Unbounded Memory Growth in QUIC Server Incoming Channel Queue

    Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can m…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-14457

    RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

    Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys an…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-18798

    QUIC Server May Trigger Double Free When Processing INITIAL Packet

    Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-54874

    Excessive Memory Use Buffering DTLS Records for a Future Epoch

    Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpo…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63072 Public exploit

    Heap Buffer Overflow in CMS Key Unwrapping

    Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63075

    QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

    Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A rem…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63076

    Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

    Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which i…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-63074

    CMP Indefinite Cache Growth of ExtraCerts

    Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraC…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2515348
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517559
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517560
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517561
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517562
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517564
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517565
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517566
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517570
  • article
    https://issues.redhat.com/browse/RHEL-212362
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67154.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-14456
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-14456
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-14456
  • article
    https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9
  • article
    https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b
  • article
    https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139
  • article
    https://openssl-library.org/news/secadv/20260813.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-14457
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-14457
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-14457
  • article
    https://openssl-library.org/news/secadv/20260825.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-18798
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-18798
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-18798
  • report
    https://access.redhat.com/security/cve/CVE-2026-54874
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54874
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54874
  • report
    https://access.redhat.com/security/cve/CVE-2026-63072
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63072
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63072
  • report
    https://access.redhat.com/security/cve/CVE-2026-63073
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63073
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63073
  • report
    https://access.redhat.com/security/cve/CVE-2026-63074
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63074
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63074
  • report
    https://access.redhat.com/security/cve/CVE-2026-63075