Skip to content
OpenAdvisories
Critical SUSE-RU-2026:5150-1 1 CVE

Recommended update for openssl-3

Published Nov 9, 2026 · Updated Nov 10, 2026

Ecosystem: SUSE

Summary

This update for openssl-3 fixes the following issues:

- Allow to bypass the strict tag initialization and length
enforcement added in the fix for CVE-2026-34182 when the env
variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and
set to a non-zero value. (bsc#1281325)

Fixed packages 2

ReleasePackageFixed in
SUSE · SLES 15 SP6 Linux Enterprise Server 15 SP6-LTSS openssl-3 3.1.4-150600.5.70.1
SUSE · SLES for SAP 15 SP6 Linux Enterprise Server for SAP Applications 15 SP6 openssl-3 3.1.4-150600.5.70.1

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-34182

    CMS AuthEnvelopedData Processing May Accept Forged Messages

    Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.suse.com/1281325
  • web
    https://www.suse.com/security/cve/CVE-2026-34182