{"id":"CVE-2025-15468","aliases":["ALPINE-CVE-2025-15468","ALSA-2026:1472","ALSA-2026:1473","AZL-75278","BELL-CVE-2025-15468","CLSA-2026-1770667352","DEBIAN-CVE-2025-15468","EUVD-2025-206400","GHSA-rhx3-fg8p-f9m4","JLSEC-2026-257","RHSA-2026:1472","RHSA-2026:1473","RHSA-2026:7261","RLSA-2026:1472","RLSA-2026:1473","SUSE-SU-2026:20211-1","SUSE-SU-2026:20223-1","SUSE-SU-2026:20542-1","SUSE-SU-2026:20607-1","SUSE-SU-2026:21544-1","SUSE-SU-2026:22143-1","SUSE-SU-2026:2411-1","SUSE-SU-2026:2662-1","UBUNTU-CVE-2025-15468","USN-7980-1","openSUSE-SU-2026:10237-1","openSUSE-SU-2026:20152-1","openSUSE-SU-2026:20673-1"],"status":"published","title":"NULL dereference in SSL_CIPHER_find() function on unknown cipher ID","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00819,"percentile":0.57453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-01-27T00:00:00Z","modified":"2026-10-29T11:58:15Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.5-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.4-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.5.5-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.5.5+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_6.1.tuxcare.6.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_6.1.tuxcare.6.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_6.1.tuxcare.6.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_6.1.tuxcare.6.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1~deb13u1","3.5.5-1~deb13u2"]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0+0"},{"fixed":"3.5.5+0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-150600.13.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-150700.16.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu1"}]}],"versions":["3.5.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.21"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.7"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12}],"products":[{"vendor":"openssl","product":"openssl"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260127.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rhx3-fg8p-f9m4","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-15468","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1472","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15467","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68160","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69418","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69419","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69420","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69421","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22796","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430375","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430376","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430377","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430378","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430379","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430380","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430381","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430386","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430387","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430388","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430389","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430390","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-1472.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1473","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-1473.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-15468","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1770667352.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15468.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-15468","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430390","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1472.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11187","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15468","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15469","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66199","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1473.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7261","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9232","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31790","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2673","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7261.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9231","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2673","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260313.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28386","tags":["advisory"]},{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1472","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1473","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620211-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256829","tags":["report"]},{"url":"https://bugzilla.suse.com/1256830","tags":["report"]},{"url":"https://bugzilla.suse.com/1256831","tags":["report"]},{"url":"https://bugzilla.suse.com/1256832","tags":["report"]},{"url":"https://bugzilla.suse.com/1256833","tags":["report"]},{"url":"https://bugzilla.suse.com/1256834","tags":["report"]},{"url":"https://bugzilla.suse.com/1256835","tags":["report"]},{"url":"https://bugzilla.suse.com/1256836","tags":["report"]},{"url":"https://bugzilla.suse.com/1256837","tags":["report"]},{"url":"https://bugzilla.suse.com/1256838","tags":["report"]},{"url":"https://bugzilla.suse.com/1256839","tags":["report"]},{"url":"https://bugzilla.suse.com/1256840","tags":["report"]},{"url":"https://bugzilla.suse.com/1257274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22796","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620223-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620542-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250410","tags":["report"]},{"url":"https://bugzilla.suse.com/1256876","tags":["report"]},{"url":"https://bugzilla.suse.com/1256878","tags":["report"]},{"url":"https://bugzilla.suse.com/1256880","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620607-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621544-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259271","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://bugzilla.suse.com/1266389","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262411-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262662-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-15468","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7980-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-66199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22796","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9232","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-15468","title":"NULL dereference in SSL_CIPHER_find() function on unknown cipher ID","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:01:20.824Z","modified":"2026-01-29T14:53:03.572Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-206400","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:01:20Z","modified":"2026-01-29T14:53:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:45.944715Z"}],"ghsa":[{"id":"GHSA-rhx3-fg8p-f9m4","title":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client...","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T18:32:15Z","modified":"2026-01-29T15:31:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:05:58.473482Z"}],"nvd":[{"id":"CVE-2025-15468","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14.4Z","modified":"2026-06-17T08:37:50.723Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"ALPINE-CVE-2025-15468","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14.4Z","modified":"2026-08-27T22:18:02.775617009Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-15468","status":"published","published":"2026-01-28T06:07:40.269379Z","modified":"2026-01-31T07:15:39.068815Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-15468","title":"NULL dereference in SSL_CIPHER_find() function on unknown cipher ID","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:01:20.824Z","modified":"2026-10-28T10:59:16.726347978Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-15468","description":"Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs.  Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service.  Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported.  As it is not very common to call this function in applications using the QUIC  protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity.  The vulnerable code was introduced in the 3.2 version with the addition of the QUIC protocol support.  The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the QUIC implementation is outside the OpenSSL FIPS module boundary.  OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.  OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14.4Z","modified":"2026-09-01T20:05:41.459972582Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"JLSEC-2026-257","title":"Issue summary: If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or...","description":"Issue summary: If an application using the `SSL_CIPHER_find()` function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call `SSL_CIPHER_find()` from the `client_hello_cb` callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC\nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-07-25T18:24:09.782523822Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2026:1472","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:20:55Z","modified":"2026-10-20T10:04:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1473","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:20:56Z","modified":"2026-10-20T10:04:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:7261","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:08Z","modified":"2026-10-20T10:15:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:1472","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n\n* openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n\n* openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n\n* openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n\n* openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n\n* openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n\n* openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n\n* openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n\n* openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n\n* openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n\n* openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n\n* openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-30T22:11:19.202965Z","modified":"2026-01-30T22:29:59.291375Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:1473","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n\n* openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n\n* openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n\n* openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n\n* openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n\n* openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n\n* openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n\n* openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n\n* openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n\n* openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n\n* openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n\n* openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-30T22:09:16.253957Z","modified":"2026-01-30T22:29:58.96266Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-15468","description":"Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported. As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity. The vulnerable code was introduced in the 3.2 version with the addition of the QUIC protocol support. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the QUIC implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T00:00:00Z","modified":"2026-05-20T16:20:23.210738079Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2026:1472","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n  * openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n  * openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n  * openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n  * openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n  * openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n  * openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n  * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n  * openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n  * openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n  * openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n  * openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-28T00:00:00Z","modified":"2026-10-29T11:58:15.407173Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:1473","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n  * openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n  * openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n  * openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n  * openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n  * openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n  * openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n  * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n  * openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n  * openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n  * openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n  * openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-28T00:00:00Z","modified":"2026-10-29T11:32:20.945833461Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-75278","title":"CVE-2025-15468 affecting package openssl for versions less than 3.3.5-3","description":"Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14Z","modified":"2026-06-27T05:26:09Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"CLSA-2026-1770667352","title":"openssl: Fix of 3 CVEs","description":"- CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes\n  unauthenticated/unencrypted by advancing pointers after stream processing\n- CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response\n  for signing certificate attributes\n- CVE-2025-15468: add a NULL guard before dereferencing SSL_CIPHER to prevent abnormal\n  termination of the running process causing Denial of Service","status":"published","published":"2026-02-09T20:02:36Z","modified":"2026-10-21T10:45:44.246491114Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"openSUSE-SU-2026:10237-1","title":"libopenssl-3-devel-3.5.3-2.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-23T00:00:00Z","modified":"2026-03-23T04:54:36.738682Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20152-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).\n - CVE-2025-15469: \"openssl dgst\" one-shot codepath silently truncates inputs \u003e16MB (bsc#1256832).\n - CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n\nOther fixes:\n\n- Enable livepatching support for ppc64le (bsc#1257274).\n","status":"published","published":"2026-02-02T13:00:02Z","modified":"2026-03-23T04:54:46.190377Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20673-1","title":"Security update for openssl-3-x86_64-v3-livepatches","description":"This update for openssl-3-x86_64-v3-livepatches fixes the following issues:\n\nChanges in openssl-3-x86_64-v3-livepatches:\n\n- Add package for libopenssl3-x86-64-v3-3.5.0 (bsc#1259271).\n\nFixed:\n\n- CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230) (bsc#1250410).\n","status":"withdrawn","published":"2026-05-05T00:19:27Z","modified":"2026-05-08T14:01:49.062967Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:20211-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).\n - CVE-2025-15469: \"openssl dgst\" one-shot codepath silently truncates inputs \u003e16MB (bsc#1256832).\n - CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n\nOther fixes:\n\n- Enable livepatching support for ppc64le (bsc#1257274).\n","status":"published","published":"2026-02-02T12:59:47Z","modified":"2026-03-23T04:52:44.130563Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20223-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).\n - CVE-2025-15469: \"openssl dgst\" one-shot codepath silently truncates inputs \u003e16MB (bsc#1256832).\n - CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n\nOther fixes:\n\n- Enable livepatching support for ppc64le (bsc#1257274).\n","status":"published","published":"2026-02-02T12:59:47Z","modified":"2026-03-23T04:52:45.200487Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20542-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues:\n\n- CVE-2025-11187: Fixed improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (bsc#1250410).\n","status":"published","published":"2026-02-18T16:23:27Z","modified":"2026-03-23T04:53:03.248739Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20607-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues:\n\n- CVE-2025-11187: Fixed improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (bsc#1250410).\n","status":"published","published":"2026-02-18T16:23:27Z","modified":"2026-03-23T04:53:04.111495Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21544-1","title":"Security update for openssl-3-x86_64-v3-livepatches","description":"This update for openssl-3-x86_64-v3-livepatches fixes the following issues:\n\nChanges in openssl-3-x86_64-v3-livepatches:\n\n- Add package for libopenssl3-x86-64-v3-3.5.0 (bsc#1259271).\n\nFixed:\n\n- CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230) (bsc#1250410).\n","status":"published","published":"2026-05-05T00:19:27Z","modified":"2026-05-12T18:26:59.951341Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22143-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues\n\n- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256878).\n- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266389, bsc#1266357).\n","status":"published","published":"2026-06-11T12:51:17Z","modified":"2026-06-18T18:24:21.289095637Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2411-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues:\n\n- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256878).\n- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266389, bsc#1266357).\n","status":"published","published":"2026-06-16T08:07:30Z","modified":"2026-06-17T09:15:05.406959105Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2662-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues\n\n- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256878).\n- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266389, bsc#1266357).\n","status":"published","published":"2026-06-26T13:59:10Z","modified":"2026-06-27T08:45:06.585672354Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-7980-1","title":"openssl vulnerabilities","description":"Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL\nincorrectly validated PBMAC1 parameters when doing PKCS#12 MAC\nverification. An attacker could possibly use this issue to cause OpenSSL to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n25.10. (CVE-2025-11187)\n\nStanislav Fort discovered that OpenSSL incorrectly parsed CMS\nAuthEnvelopedData messages. An attacker could possibly use this issue to\ncause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)\n\nStanislav Fort discovered that OpenSSL incorrectly handled memory in the\nSSL_CIPHER_find() function. An attacker could possibly use this issue to\ncause OpenSSL to crash, resulting in a denial of service. This issue only\naffected Ubuntu 25.10. (CVE-2025-15468)\n\nStanislav Fort discovered that the OpenSSL \"openssl dgst\" command line\ntool incorrectly truncated data to 16MB. An attacker could posibly use this\nissue to hide unauthenticated data beyond the 16MB limit. This issue only\naffected Ubuntu 25.10. (CVE-2025-15469)\n\nTomas Dulka and Stanislav Fort discovered that OpenSSL incorrectly handled\nmemory with TLS 1.3 connections using certificate compression. An attacker\ncould possibly use this issue to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 25.10. (CVE-2025-66199)\n\nPetr Simecek and Stanislav Fort discovered that OpenSSL incorrectly handled\nmemory when writing large data into a BIO chain. An attacker could possibly\nuse this issue to consume resources, leading to a denial of service.\n(CVE-2025-68160)\n\nStanislav Fort discovered that the OpenSSL OCB API could incorrectly leave\nfinal partial blocks unencrypted and unauthenticated. An attacker could\npossibly use this issue to read or tamper with the affected final bytes.\n(CVE-2025-69418)\n\nStanislav Fort discovered that OpenSSL incorrectly handled the\nPKCS12_get_friendlyname() utf-8 conversion. An attacker could possibly use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2025-69419)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE\nvalidation in the TS_RESP_verify_response() function. An attacker could\npossibly use this issue to cause OpenSSL to crash, resulting in a denial of\nservice. (CVE-2025-69420)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled memory in the\nPKCS12_item_decrypt_d2i_ex function. An attacker could possibly use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2025-69421)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE\nvalidation in PKCS#12 parsing. An attacker could possibly use this issue to\ncause OpenSSL to crash, resulting in a denial of service. (CVE-2026-22795)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE\nvalidation in the PKCS7_digest_from_attributes() function. An attacker\ncould possibly use this issue to cause OpenSSL to crash, resulting in a\ndenial of service. (CVE-2026-22796)","status":"published","published":"2026-01-27T18:10:18Z","modified":"2026-10-27T04:16:43.807335609Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}