Description
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause
memory to be accessed that was previously freed in some situations
Impact summary: A use after free can have a range of potential consequences such
as the corruption of valid data, crashes or execution of arbitrary code.
However, only applications that directly call the SSL_free_buffers function are
affected by this issue. Applications that do not call this function are not
vulnerable. Our investigations indicate that this function is rarely used by
applications.
The SSL_free_buffers function is used to free the internal OpenSSL buffer used
when processing an incoming record from the network. The call is only expected
to succeed if the buffer is not currently in use. However, two scenarios have
been identified where the buffer is freed even when still in use.
The first scenario occurs where a record header has been received from the
network and processed by OpenSSL, but the full record body has not yet arrived.
In this case calling SSL_free_buffers will succeed even though a record has only
been partially processed and the buffer is still in use.
The second scenario occurs where a full record containing application data has
been received and processed by OpenSSL but the application has only read part of
this data. Again a call to SSL_free_buffers will succeed even though the buffer
is still in use.
While these scenarios could occur accidentally during normal operation a
malicious attacker could attempt to engineer a stituation where this occurs.
We are not aware of this issue being actively exploited.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.3.0 – < 3.3.1, 3.2.0 – < 3.2.2, 3.1.0 – < 3.1.6, 3.0.0 – < 3.0.14, 1.1.1 – < 1.1.1y | 3.3.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 3.2.2-1 | — |
| Debian 13 | openssl | 3.2.2-1 | — |
| Debian 12 | openssl | 3.0.14-1~deb12u1 | — |
| Debian 11 | openssl | 1.1.1n-0+deb11u6 | DLA-3942-2, DLA-3942-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | edk2 | 2024.02-2ubuntu0.6 | USN-7894-1 |
| Ubuntu 24.04 LTS | openssl | 3.0.13-0ubuntu3.2 | USN-6937-1 |
| Ubuntu 22.04 LTS | edk2 | 2022.02-3ubuntu0.22.04.4 | USN-7894-1 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.17 | USN-6937-1 |
| Ubuntu 20.04 LTS | openssl | 1.1.1f-1ubuntu2.23 | USN-6937-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS 20.04 LTS | openssl | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | openssl | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | openssl | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | openssl-fips | 3.0.13-0ubuntu3.6+Fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssl | 3.0.2-0ubuntu1.17+Fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssl-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | openssl | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssl | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssl +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 20.04 LTS | edk2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | edk2 +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | edk2 +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | openssl | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | openssl +3 | 1:3.2.2-6.el9_5 | RHSA-2024:9333 |
| RHEL 8 | openssl +3 | 1:1.1.1k-16.el8_6 | RHSA-2026:26275 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 TUS | openssl +3 | 1:1.1.1k-16.el8_6 | RHSA-2026:26275 |
| RHEL 8.8 E4S | openssl +3 | 1:1.1.1k-16.el8_6 | RHSA-2026:26275 |
| RHEL 8.6 EUS Long Life | openssl +3 | 1:1.1.1k-16.el8_6 | RHSA-2026:26275 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | openssl +3 | 1:3.2.2-6.el9_5 | ALSA-2024:9333 |
| AlmaLinux 8 | openssl +3 | 1:1.1.1k-16.el8_6 | ALSA-2026:26275 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | edk2-ovmf +3 | 20260221-7.el10 | RLSA-2026:97212 |
| Rocky Linux 9 | openssl | 1:3.2.2-6.el9_5.1 | RLSA-2024:9333 |
| Rocky Linux 9 | openssl-fips-provider | 3.0.7-6.el9_5 | RLSA-2024:9333 |
| Rocky Linux 8 | openssl | 1:1.1.1k-16.el8_10 | RLSA-2026:26275 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | openssl-1_1 | 1.1.1w-150600.5.3.1 | SUSE-SU-2024:2059-1 |
| SLES 15 SP6 | openssl-3 | 3.1.4-150600.5.7.1 | SUSE-SU-2024:2066-1 |
| SLES 15 SP5 | openssl-1_1 | 1.1.1l-150500.17.31.1 | SUSE-SU-2024:2051-1 |
| SLES 15 SP5 | openssl-3 | 3.0.8-150500.5.36.1 | SUSE-SU-2024:2020-1 |
| SLES 15 SP4 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SLES 15 SP4 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SLES 15 SP3 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SLES 15 SP2 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
Show 21 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | openssl-1_1 | 1.1.1d-2.107.1 | SUSE-SU-2024:2036-1 |
| SLES for SAP 15 SP4 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SLES for SAP 15 SP4 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SLES for SAP 15 SP3 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SLES for SAP 15 SP2 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SLES for SAP 12 SP5 | openssl-1_1 | 1.1.1d-2.107.1 | SUSE-SU-2024:2036-1 |
| SLE Micro 6.0 | jitterentropy | 3.4.1-3.1 | SUSE-SU-2025:20014-1 |
| SLE Micro 6.0 | libpulp | 0.3.5-1.1 | SUSE-SU-2025:20014-1 |
| SLE Micro 6.0 | openssl-3 | 3.1.4-6.1 | SUSE-SU-2025:20014-1 |
| SLE Micro 5.5 | openssl-1_1 | 1.1.1l-150500.17.31.1 | SUSE-SU-2024:2051-2, SUSE-SU-2024:2051-1 |
| SLE Micro 5.4 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SLE Micro 5.4 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SLE Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SLE Micro 5.3 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SLE Micro 5.2 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SLE Micro 5.1 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SLE Live Patching 15 SP7 | openssl-1_1-livepatches | 0.5-150700.13.3.1 | SUSE-SU-2025:03523-1 |
| SLE Live Patching 15 SP6 | openssl-1_1-livepatches | 0.5-150600.11.3.1 | SUSE-SU-2025:03632-1 |
| SLE Live Patching 15 SP5 | openssl-1_1-livepatches | 0.4-150500.6.8.1 | SUSE-SU-2024:2271-1 |
| SLE Live Patching 15 SP4 | openssl-1_1-livepatches | 0.4-150400.3.11.1 | SUSE-SU-2024:2197-1 |
| SLE HPC 15 SP4 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SLE HPC 15 SP4 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SLE HPC 15 SP3 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SLE HPC 15 SP2 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
| SUSE Manager Server 4.3 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SUSE Manager Server 4.3 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SUSE Manager Proxy 4.3 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| SUSE Manager Proxy 4.3 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| SUSE Enterprise Storage 7.1 | openssl-1_1 | 1.1.1d-150200.11.91.1 | SUSE-SU-2024:2035-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1w-11.1 | openSUSE-SU-2024:14219-1 |
| openSUSE Tumbleweed | openssl-3 | 3.1.4-11.1 | openSUSE-SU-2024:14220-1 |
| openSUSE Leap 15.6 | openssl-1_1 | 1.1.1w-150600.5.3.1 | SUSE-SU-2024:2059-1 |
| openSUSE Leap 15.6 | openssl-3 | 3.1.4-150600.5.7.1 | SUSE-SU-2024:2066-1 |
| openSUSE Leap 15.5 | openssl-1_1 | 1.1.1l-150500.17.31.1 | SUSE-SU-2024:2051-1 |
| openSUSE Leap 15.5 | openssl-3 | 3.0.8-150500.5.36.1 | SUSE-SU-2024:2020-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| openSUSE Leap Micro 5.4 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
| openSUSE Leap Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.69.1 | SUSE-SU-2024:2089-1 |
| openSUSE Leap Micro 5.3 | openssl-3 | 3.0.8-150400.4.57.1 | SUSE-SU-2024:2088-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssl | 3.3.0-r3 | — |
| Alpine v3.23 | openssl | 3.3.0-r3 | — |
| Alpine v3.22 | openssl | 3.3.0-r3 | — |
| Alpine v3.21 | openssl | 3.3.0-r3 | — |
| Alpine v3.20 | openssl | 3.3.0-r3 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssl | 3.1.6-r0 | — |
| Alpine v3.18 | openssl | 3.1.6-r0 | — |
| Alpine v3.17 | openssl | 3.0.14-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openssl +4 | 1:3.0.8-1.amzn2023.0.14 | ALAS2023-2024-677 |
| Amazon Linux 2 | openssl11 +3 | 1:1.1.1g-12.amzn2.0.23 | ALAS2-2024-2621 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | edk2 | 20240524git3e722403cd16-6 | — |
| Azure Linux 3 | openssl-fips-provider | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | hvloader | 1.0.1-6 | — |
| Azure Linux 2 (CBL-Mariner) | openssl | 1.1.1k-31 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | openssl +3 | 1:3.2.2-6.0.1.el9_5 | ELSA-2024-9333 |
| Oracle Linux 9 | openssl-fips-provider +1 | 3.0.7-6.0.1.el9_5 | ELSA-2024-9333 |
| Oracle Linux 8 | openssl +3 | 1:1.1.1k-16.el8_6 | ELSA-2026-26275 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openssl +1 | 3.3.1-r0 | — |
Advisories 50
- RLSA-2026:97212 Low: edk2 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2024-1240 OpenSSL: Schwachstelle ermöglicht Codeausführung, Datenmanipulation, Offenlegung von Informationen und Dos BSI CERT-Bund (WID) · Nov 12, 2026
- USN-7894-1 edk2 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-6937-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- ALSA-2024:9333 Low: openssl security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26275 Important: openssl security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:26275 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:9333 Red Hat Security Advisory: openssl and openssl-fips-provider security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2026-2912 Dell PowerScale OneFS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 30, 2026
- RLSA-2026:26275 Important: openssl security update Rocky Linux Security Advisories · Jun 17, 2026
- ELSA-2026-26275 Important: openssl security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 16, 2026
- SUSE-SU-2025:20014-1 Security update for openssl-3, libpulp, ulp-macros SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03632-1 Security update for openssl-1_1-livepatches SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3942-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3942-2 openssl - regression update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSA-25-226-15 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-613116 SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1 Siemens ProductCERT · Feb 24, 2026
- RLSA-2024:9333 Low: openssl and openssl-fips-provider security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:2197-1 Security update for openssl-1_1-livepatches SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2051-2 Security update for openssl-1_1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2088-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2089-1 Security update for openssl-1_1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2036-1 Security update for openssl-1_1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2035-1 Security update for openssl-1_1 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14219-1 libopenssl-1_1-devel-1.1.1w-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2020-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2271-1 Security update for openssl-1_1-livepatches SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2066-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14220-1 libopenssl-3-devel-3.1.4-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2059-1 Security update for openssl-1_1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03523-1 Security update for openssl-1_1-livepatches SUSE / openSUSE Security Updates · Oct 10, 2025
- WID-SEC-2025-0225 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2025
- WID-SEC-2024-2112 Insyde UEFI Firmware: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Aug 4, 2025
- VDE-2024-071 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- ICSA-25-044-09 Siemens SCALANCE W700 IEEE 802.11ax CISA ICS & IT advisories · May 6, 2025
- ICSA-24-319-06 Siemens SCALANCE M-800 Family CISA ICS & IT advisories · May 6, 2025
- SUSE-SU-2024:2051-1 Security update for openssl-1_1 SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0061 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 14, 2025
- NCSC-2025-0051 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 11, 2025
- SSA-769027 SSA-769027: Multiple Vulnerabilities fixed in SCALANCE W700 IEEE 802.11ax devices before V3.0.0 Siemens ProductCERT · Feb 11, 2025
- NCSC-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2025-0023 Kwetsbaarheden verholpen in Oracle PeopleSoft NCSC-NL (Netherlands) · Jan 22, 2025
- ELSA-2024-9333 Low: openssl and openssl-fips-provider security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 14, 2024
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-354112 SSA-354112: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.2 Siemens ProductCERT · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3199 Oracle Secure Backup: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- ALAS2-2024-2621 Moderate: openssl11 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 13, 2024
References
- OpenSSL Advisory vendor-advisory
- 3.3.1 git commit patch
- 3.2.2 git commit patch
- 3.1.6 git commit patch
- 3.0.14 git commit patch
- 1.1.1y git commit patch