Every CVE Search/ Get API key

CVE-2026-34183

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

7.5 HighFix available

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.05%Up 1.0 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1325
Updated
2026-11-02
EUVDEUVD-2026-35479 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
EUVD-2026-35479
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-f5vx-f6jp-89j6 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it...

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
GHSA-f5vx-f6jp-89j6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1325
Updated
2026-11-02
NVD 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1325
Updated
2026-11-02
OSVALPINE-CVE-2026-34183 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
ALPINE-CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-34183 7.5
Record
BELL-CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 27 moreShow less
OSV 7.5

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1325
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34183 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
DEBIAN-CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-1136 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it...

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
JLSEC-2026-1136
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:25237 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:25237
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:25239 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:25239
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42825 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:42825
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:55543 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:55543
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59635 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:59635
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59641 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:59641
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62562 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:62562
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62563 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:62563
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62790 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:62790
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67551 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:67551
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:71542 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:71542
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:83617 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:83617
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:25237 9.1

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)

  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)

  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)

  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25237
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:25239 9.1

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)

  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)

  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)

  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25239
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34183 7.5

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
UBUNTU-CVE-2026-34183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:25237 No score

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)
  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)
  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)
  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)
  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25237
Updated
2026-11-02
OSVALSA-2026:25239 No score

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)
  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)
  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)
  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)
  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25239
Updated
2026-11-02
OSVAZL-89925 No score

CVE-2026-34183 affecting package openssl for versions less than 3.3.7-3

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Record
AZL-89925
Updated
2026-11-05
OSVMGASA-2026-0253 No score

Updated openssl packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. (CVE-2026-7383) Out-of-Bounds Read in CMS Password-Based Decryption. (CVE-2026-9076) Heap Buffer Over-read in ASN.1 Content Parsing. (CVE-2026-34180) PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys. (CVE-2026-34181) CMS AuthEnvelopedData Processing May Accept Forged Messages. (CVE-2026-34182) Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler. (CVE-2026-34183) NULL Pointer Dereference in QUIC Server Initial Packet Handling. (CVE-2026-42764) Possible NULL Dereference in Password-Based CMS Decryption. (CVE-2026-42766) NULL Pointer Dereference in CRMF EncryptedValue Decryption. (CVE-2026-42767) Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt(). (CVE-2026-42768) Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate. (CVE-2026-42769) FFC-DH Peer Validation Uses Attacker-Supplied q. (CVE-2026-42770) AES-OCB IV Ignored on EVP_Cipher() Path. (CVE-2026-45445) Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446) Heap Use-After-Free in the PKCS7_verify(). (CVE-2026-45447)

Record
MGASA-2026-0253
Updated
2026-11-02
OSVopenSUSE-SU-2026:11023-1 No score

libopenssl-3-devel-3.5.3-6.1 on GA media

These are all security issues fixed in the libopenssl-3-devel-3.5.3-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11023-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21005-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
openSUSE-SU-2026:21005-1
Updated
2026-11-02
OSVSUSE-SU-2026:22251-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:22251-1
Updated
2026-11-02
OSVSUSE-SU-2026:22315-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:22315-1
Updated
2026-11-02
OSVSUSE-SU-2026:2648-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:2648-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Alpine:v3.21
 3.4.0 up to 3.3.7-r1
3.3.7-r1
openssl
Alpine:v3.22
 3.4.0 up to 3.5.7-r0
3.5.7-r0
openssl
Alpine:v3.23
 3.4.0 up to 3.5.7-r0
3.5.7-r0
openssl
Alpine:v3.24
 3.4.0 up to 3.5.7-r0
3.5.7-r0
openssl
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl-devel
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl-libs
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl-perl
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-devel
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
Show 131 moreShow less
Affected packages
PackageAffectedFixed
openssl-libs
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-perl
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl
Azure Linux:3
 before 3.3.7-3
3.3.7-3
openssl
Alpaquita:25
 3.5.0-r0 up to 3.5.7-r0
3.5.7-r0
openssl
Alpaquita:stream
 3.1.1-r1 up to 3.5.7-r0
3.5.7-r0
openssl
BellSoft Hardened Containers:25
 3.5.0-r0 up to 3.5.7-r0
3.5.7-r0
openssl
BellSoft Hardened Containers:stream
 3.1.1-r1 up to 3.5.7-r0
3.5.7-r0
openssl
Debian:13
 before 3.5.6-1~deb13u2, plus listed versions
3.5.1-13.5.1-1+deb13u13.5.2-13.5.3-13.5.4-1
Show 6 moreShow less
3.5.4-1~deb13u13.5.4-1~deb13u23.5.5-13.5.5-1~deb13u13.5.5-1~deb13u23.5.6-1~deb13u1
3.5.6-1~deb13u2
openssl
Debian:14
 before 3.6.3-1, plus listed versions
3.5.1-13.5.2-13.5.3-13.5.4-13.5.4-1~deb13u1
Show 17 moreShow less
3.5.4-1~deb13u23.5.5-13.5.5-1~deb13u13.5.5-1~deb13u23.5.6-1~deb13u13.5.6-1~deb13u23.5.7-1~deb13u13.5.7-1~deb13u23.5.7-1~deb13u33.6.0-13.6.0-23.6.0~~alpha1-13.6.0~~beta1-13.6.1-13.6.1-23.6.1-33.6.2-1
3.6.3-1
AppBundler
Julia
 1.0.0 up to 1.0.1
1.0.1
OpenSSL_jll
Julia
 3.5.0+0 up to 3.5.7+0
3.5.7+0
Openresty_jll
Julia
 1.29.203+0 and later None known
openssl
Mageia:10
From an advisory covering 15 CVEs
 before 3.5.7-1.mga10
3.5.7-1.mga10
openssl
Mageia:9
From an advisory covering 15 CVEs
 before 3.0.21-1.mga9
3.0.21-1.mga9
openssl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-perl
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-perl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-libs
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
chunkah
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.6.0-3.hum1
0:0.6.0-3.hum1
python-cryptography
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:50.0.0-1.hum1
0:50.0.0-1.hum1
python3-cryptography
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:50.0.0-1.hum1
0:50.0.0-1.hum1
openssl3
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl3-devel
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl3-devel-engine
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl3-libs
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-config-fips
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-devel
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-devel-engine
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-fips-provider-upstream
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-libs
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-perl
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
ruby3.3
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-default-gems
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-devel
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-doc
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-libs
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
rubygem3.3-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.1.5-23.6.hum1
0:3.1.5-23.6.hum1
rubygem3.3-bundler
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:2.5.22-23.6.hum1
0:2.5.22-23.6.hum1
rubygem3.3-devel
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.5.22-23.6.hum1
0:3.5.22-23.6.hum1
rubygem3.3-io-console
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:0.7.1-23.6.hum1
0:0.7.1-23.6.hum1
rubygem3.3-irb
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:1.13.1-23.6.hum1
0:1.13.1-23.6.hum1
rubygem3.3-json
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:2.7.2-23.6.hum1
0:2.7.2-23.6.hum1
rubygem3.3-minitest
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:5.20.0-23.6.hum1
0:5.20.0-23.6.hum1
rubygem3.3-power_assert
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:2.0.3-23.6.hum1
0:2.0.3-23.6.hum1
rubygem3.3-psych
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:5.1.2-23.6.hum1
0:5.1.2-23.6.hum1
rubygem3.3-racc
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:1.7.3-23.6.hum1
0:1.7.3-23.6.hum1
rubygem3.3-rake
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:13.1.0-23.6.hum1
0:13.1.0-23.6.hum1
rubygem3.3-rbs
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.4.0-23.6.hum1
0:3.4.0-23.6.hum1
rubygem3.3-rdoc
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:6.6.3.1-23.6.hum1
0:6.6.3.1-23.6.hum1
rubygem3.3-rexml
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.4.4-23.6.hum1
0:3.4.4-23.6.hum1
rubygem3.3-rss
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:0.3.1-23.6.hum1
0:0.3.1-23.6.hum1
rubygem3.3-rubygems
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.5.22-23.6.hum1
0:3.5.22-23.6.hum1
rubygem3.3-test-unit
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.6.1-23.6.hum1
0:3.6.1-23.6.hum1
rubygem3.3-typeprof
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:0.21.9-23.6.hum1
0:0.21.9-23.6.hum1
ruby4.0
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-default-gems
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-doc
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-libs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
rubygem4.0-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.1-37.3.hum1
0:4.0.1-37.3.hum1
rubygem4.0-bundler
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.16-37.3.hum1
0:4.0.16-37.3.hum1
rubygem4.0-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.16-37.3.hum1
0:4.0.16-37.3.hum1
rubygem4.0-io-console
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.8.2-37.3.hum1
0:0.8.2-37.3.hum1
rubygem4.0-irb
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:1.16.0-37.3.hum1
0:1.16.0-37.3.hum1
rubygem4.0-json
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:2.18.0-37.3.hum1
0:2.18.0-37.3.hum1
rubygem4.0-minitest
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:6.0.0-37.3.hum1
0:6.0.0-37.3.hum1
rubygem4.0-power_assert
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.0.1-37.3.hum1
0:3.0.1-37.3.hum1
rubygem4.0-psych
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:5.3.1-37.3.hum1
0:5.3.1-37.3.hum1
rubygem4.0-racc
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:1.8.1-37.3.hum1
0:1.8.1-37.3.hum1
rubygem4.0-rake
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:13.3.1-37.3.hum1
0:13.3.1-37.3.hum1
rubygem4.0-rbs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.10.0-37.3.hum1
0:3.10.0-37.3.hum1
rubygem4.0-rdoc
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:7.0.4-37.3.hum1
0:7.0.4-37.3.hum1
rubygem4.0-rexml
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.4.4-37.3.hum1
0:3.4.4-37.3.hum1
rubygem4.0-rss
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.3.2-37.3.hum1
0:0.3.2-37.3.hum1
rubygem4.0-rubygems
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.16-37.3.hum1
0:4.0.16-37.3.hum1
rubygem4.0-test-unit
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.7.5-37.3.hum1
0:3.7.5-37.3.hum1
rubygem4.0-typeprof
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.31.1-37.3.hum1
0:0.31.1-37.3.hum1
ruby3.4
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-default-gems
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-devel
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-doc
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-libs
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
bootupd
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:0.3.2-1.hum1
0:0.3.2-1.hum1
rust-bootupd
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:0.3.2-1.hum1
0:0.3.2-1.hum1
openssl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-perl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-perl
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debuginfo
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debugsource
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-libs
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl
Rocky Linux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl
Rocky Linux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-3
SUSE:Linux Micro 6.2
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1
openssl-3
SUSE:Linux Enterprise Server 16.0
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1
openssl-3
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1
openssl-3
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 13 CVEs
 before 3.2.3-150700.5.36.1
3.2.3-150700.5.36.1
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
edk2
Ubuntu:25.10
 All versions, plus listed versions
2025.02-3ubuntu22025.02-82025.02-8ubuntu12025.02-8ubuntu22025.02-8ubuntu32025.02-8ubuntu3.12025.02-8ubuntu3.2
 None known
openssl
Ubuntu:25.10
 before 3.5.3-1ubuntu3.4, plus listed versions
3.4.1-1ubuntu33.5.0-2ubuntu13.5.2-1ubuntu13.5.3-1ubuntu23.5.3-1ubuntu33.5.3-1ubuntu3.3
3.5.3-1ubuntu3.4
edk2
Ubuntu:26.10
 All versions, plus listed versions
2025.11-3ubuntu72025.11-3ubuntu82026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3
 None known
edk2-hwe
Ubuntu:26.10
 All versions, plus listed versions
2025.11-3ubuntu82025.11-3ubuntu92026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3
 None known
edk2
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.02-8ubuntu32025.11-3ubuntu62025.11-3ubuntu72025.11-3ubuntu7.22025.11-3ubuntu7.3
 None known
edk2-hwe
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.11-3ubuntu62025.11-3ubuntu82025.11-3ubuntu8.2
 None known
openssl
Ubuntu:26.04:LTS
 before 3.5.5-1ubuntu3.2, plus listed versions
3.5.3-1ubuntu23.5.5-1ubuntu13.5.5-1ubuntu3
3.5.5-1ubuntu3.2
openssl-3
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.5.3-6.1
3.5.3-6.1
openssl-3
openSUSE:Leap 16.0
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34183 is a high vulnerability (CVSS 7.5) in Openssl, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in openssl 3.3.7-r1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 90 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open