Skip to content
OpenAdvisories
High RLSA-2026:26275 2 CVEs

Important: openssl security update

Published Jun 17, 2026 · Updated Jun 17, 2026

Ecosystem: Rocky Linux

Summary

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

* openssl: Use After Free with SSL_free_buffers (CVE-2024-4741)

* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 openssl 1:1.1.1k-16.el8_10

Vulnerabilities 2

  • Critical 9.8
    CVE-2024-4741

    Use After Free with SSL_free_buffers

    Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cra…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-45447 Public exploit

    Heap Use-After-Free in the PKCS7_verify() Function

    Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2283757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481898