Skip to content
OpenAdvisories
Critical RHSA-2026:7261 23 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Apr 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 openssl 0:3.5.6-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 openssl-config-fips 0:3.5.6-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 openssl-devel 0:3.5.6-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 openssl-devel-engine 0:3.5.6-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 openssl-libs 0:3.5.6-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 openssl-perl 0:3.5.6-0.1.hum1

Vulnerabilities 23

  • Critical 9.8
    CVE-2025-9230

    Out-of-bounds read & write in RFC 3211 KEK Unwrap

    Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2026-28386

    Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support

    Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a cra…

    OpenSSL OpenSSL openssl openssl Debian Wolfi
  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-28387

    Potential Use-after-free in DANE Client Code

    Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free ca…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-69420 Public exploit

    Missing ASN1_TYPE validation in TS_RESP_verify_response() function

    Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStam…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-69421 Public exploit

    NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

    Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processi…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-28388

    NULL Pointer Dereference When Processing a Delta CRL

    Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-28389

    Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic o…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-28390

    Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-31790

    Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2025-69419 Public exploit

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2026-2673

    OpenSSL TLS 1.3 server may choose unexpected key agreement group

    Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used e…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 6.1
    CVE-2025-11187 Public exploit

    Improper validation of PBMAC1 parameters in PKCS#12 MAC verification

    Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereferenc…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.9
    CVE-2025-15468

    NULL dereference in SSL_CIPHER_find() function on unknown cipher ID

    Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of th…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2025-66199

    TLS 1.3 CompressedCertificate excessive memory allocation

    Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocat…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2025-9231

    Timing side-channel in SM2 algorithm on 64 bit ARM

    Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platfor…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.9
    CVE-2025-9232

    Out-of-bounds read in HTTP client no_proxy handling

    Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An ou…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.8
    CVE-2026-31789

    Heap Buffer Overflow in Hexadecimal Conversion

    Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or othe…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.5
    CVE-2025-15469

    'openssl dgst' one-shot codepath silently truncates inputs >16MB

    Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorith…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.5
    CVE-2026-22795

    Missing ASN1_TYPE validation in PKCS#12 parsing

    Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-22796

    ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

    Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PK…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.7
    CVE-2025-68160

    Heap out-of-bounds write in BIO_f_linebuffer on short writes

    Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.0
    CVE-2025-69418

    Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

    Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: Th…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2025-9232
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2025-9231
  • report
    https://access.redhat.com/security/cve/CVE-2025-9230
  • report
    https://access.redhat.com/security/cve/CVE-2025-11187
  • report
    https://access.redhat.com/security/cve/CVE-2025-69421
  • report
    https://access.redhat.com/security/cve/CVE-2025-69420
  • report
    https://access.redhat.com/security/cve/CVE-2025-69419
  • report
    https://access.redhat.com/security/cve/CVE-2025-69418
  • report
    https://access.redhat.com/security/cve/CVE-2025-68160
  • report
    https://access.redhat.com/security/cve/CVE-2025-66199
  • report
    https://access.redhat.com/security/cve/CVE-2025-15469
  • report
    https://access.redhat.com/security/cve/CVE-2025-15468
  • report
    https://access.redhat.com/security/cve/CVE-2025-15467
  • report
    https://access.redhat.com/security/cve/CVE-2026-31790
  • report
    https://access.redhat.com/security/cve/CVE-2026-31789
  • report
    https://access.redhat.com/security/cve/CVE-2026-28389
  • report
    https://access.redhat.com/security/cve/CVE-2026-28388
  • report
    https://access.redhat.com/security/cve/CVE-2026-28387
  • report
    https://access.redhat.com/security/cve/CVE-2026-28386
  • report
    https://access.redhat.com/security/cve/CVE-2026-28390
  • report
    https://access.redhat.com/security/cve/CVE-2026-22795
  • report
    https://access.redhat.com/security/cve/CVE-2026-2673
  • report
    https://access.redhat.com/security/cve/CVE-2026-22796
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7261.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396054
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-9230
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-9230
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396055
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-9231
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-9231
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396056
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-9232
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-9232
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430375
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-11187
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-11187
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430376