{"id":"CVE-2026-2673","aliases":["ALPINE-CVE-2026-2673","ALSA-2026:19066","ALSA-2026:22312","BELL-CVE-2026-2673","DEBIAN-CVE-2026-2673","EUVD-2026-12033","GHSA-wj64-gh9j-xm82","JLSEC-2026-271","RHSA-2026:19066","RHSA-2026:22312","RHSA-2026:7261","SUSE-SU-2026:21107-1","SUSE-SU-2026:21186-1","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","UBUNTU-CVE-2026-2673","USN-8155-1","openSUSE-SU-2026:10533-1","openSUSE-SU-2026:20525-1","openSUSE-SU-2026:21005-1"],"status":"published","title":"OpenSSL TLS 1.3 server may choose unexpected key agreement group","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00484,"percentile":0.41986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-757"],"published":"2026-03-13T13:23:00Z","modified":"2026-10-29T11:42:25Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.5-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.5-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.5-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.5-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.5-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.6.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"AppBundler","fixed_in":["1.0.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.5.6+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"openssl","fixed_in":["3.5.5-1ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.23"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssl","fixed_in":["3.0.13-0ubuntu3.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3"]},{"source":"osv","ecosystem":"Julia","package":"AppBundler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0+0"},{"fixed":"3.5.6+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.203+0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-2.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.23"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.9"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15}],"products":[{"vendor":"openssl","product":"openssl"},{"vendor":"siemens","product":"simatic cn 4100"},{"vendor":"siemens","product":"simatic_cn_4100_firmware"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260313.txt","tags":["vendor-advisory","Vendor Advisory","web","article","report"]},{"url":"https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f","tags":["patch","Patch","fix","web","article"]},{"url":"https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34","tags":["patch","Patch","fix","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/13/3","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2673","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wj64-gh9j-xm82","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-2673","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19066","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31790","tags":["report"]},{"url":"https://bugzilla.redhat.com/2451094","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19066.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-2673.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22312","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://bugzilla.redhat.com/2456314","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-22312.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-2673","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2673","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451094","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19066.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2673","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","tags":["advisory"]},{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22312.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7261","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9232","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69421","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69420","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69419","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69418","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68160","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15467","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22796","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7261.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9231","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11187","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430376","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15469","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66199","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28386","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621107-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259652","tags":["report"]},{"url":"https://bugzilla.suse.com/1260441","tags":["report"]},{"url":"https://bugzilla.suse.com/1260442","tags":["report"]},{"url":"https://bugzilla.suse.com/1260443","tags":["report"]},{"url":"https://bugzilla.suse.com/1260444","tags":["report"]},{"url":"https://bugzilla.suse.com/1260445","tags":["report"]},{"url":"https://bugzilla.suse.com/1261678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31790","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621186-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622251-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266344","tags":["report"]},{"url":"https://bugzilla.suse.com/1266345","tags":["report"]},{"url":"https://bugzilla.suse.com/1266347","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266350","tags":["report"]},{"url":"https://bugzilla.suse.com/1266351","tags":["report"]},{"url":"https://bugzilla.suse.com/1266352","tags":["report"]},{"url":"https://bugzilla.suse.com/1266353","tags":["report"]},{"url":"https://bugzilla.suse.com/1266355","tags":["report"]},{"url":"https://bugzilla.suse.com/1266356","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622315-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2673","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8155-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-28387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-28388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-28389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-28390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31790","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2673","title":"OpenSSL TLS 1.3 server may choose unexpected key agreement group","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T13:23:00.376Z","modified":"2026-05-18T19:23:37.078Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-757"],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-12033","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T13:23:00Z","modified":"2026-05-18T19:23:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:21:16.184545Z"}],"ghsa":[{"id":"GHSA-wj64-gh9j-xm82","title":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key...","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T21:31:46Z","modified":"2026-03-17T18:31:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-757"],"updated_at":"2026-11-02T15:06:40.510126Z"}],"nvd":[{"id":"CVE-2026-2673","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T19:54:34.033Z","modified":"2026-06-17T10:31:30.993Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-757"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"ALPINE-CVE-2026-2673","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T19:54:34.033Z","modified":"2026-10-01T02:17:49.218964746Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-2673","status":"published","published":"2026-03-14T06:07:47.309Z","modified":"2026-05-20T07:15:03.9295278Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-2673","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T19:54:34.033Z","modified":"2026-10-29T11:42:19.951820765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"DEBIAN-CVE-2026-2673","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.  Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server.  If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported.  As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction).  OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers.  The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included.  The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security.  Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group.  The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'.  No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.  OpenSSL 3.6 and 3.5 are vulnerable to this issue.  OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.  OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T19:54:34.033Z","modified":"2026-10-01T03:03:01.012427722Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"JLSEC-2026-271","title":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange...","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-08-13T13:00:04.74592256Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2026:19066","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-05-20T10:09:49Z","modified":"2026-10-20T10:05:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:22312","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-02T10:08:36Z","modified":"2026-10-20T10:06:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:7261","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:08Z","modified":"2026-10-20T10:15:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-2673","description":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers.  The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security.  Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.","status":"published","published":"2026-03-13T19:54:00Z","modified":"2026-10-17T12:58:48.178037459Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:19066","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:42:19.813155356Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:22312","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-10-29T11:42:25.662759251Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"openSUSE-SU-2026:10533-1","title":"libopenssl-3-devel-3.5.3-4.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-11T00:00:00Z","modified":"2026-04-12T10:18:35.053653Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20525-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).\n- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with\n  KeyTransportRecipientInfo (bsc#1261678).\n- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n\nOther updates and bugfixes:\n\n- Enable MD2 in legacy provider (jsc#PED-15724).\n","status":"published","published":"2026-04-13T15:48:00Z","modified":"2026-04-22T18:26:40.507754Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21005-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:26:17Z","modified":"2026-06-30T18:24:35.407904348Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:21107-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).\n- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with\n  KeyTransportRecipientInfo (bsc#1261678).\n- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n\nOther updates and bugfixes:\n\n- Enable MD2 in legacy provider (jsc#PED-15724).\n","status":"published","published":"2026-04-13T15:48:01Z","modified":"2026-04-17T18:23:56.166161Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21186-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).\n- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with\n  KeyTransportRecipientInfo (bsc#1261678).\n- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n\nOther updates and bugfixes:\n\n- Enable MD2 in legacy provider (jsc#PED-15724).\n","status":"published","published":"2026-04-13T15:48:01Z","modified":"2026-04-22T18:25:56.379835Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22251-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:23:46Z","modified":"2026-06-30T18:24:26.161789581Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22315-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:23:46Z","modified":"2026-07-02T18:24:09.732592143Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"USN-8155-1","title":"openssl vulnerabilities","description":"Viktor Dukhovni discovered that OpenSSL incorrectly negotiated the expected\npreferred key exchange group when used as a TLS 1.3 server. This could\nresult in a less preferred key exchange being used, contrary to\nexpectations. This issue only affected Ubuntu 25.10. (CVE-2026-2673)\n\nIgor Morgenstern discovered that OpenSSL incorrectly handled certain memory\noperations when used as a DANE client. A remote attacker could use this\nissue to cause OpenSSL to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2026-28387)\n\nIgor Morgenstern discovered that OpenSSL incorrectly handled certain memory\noperations when processing a delta CRL. A remote attacker could possibly\nuse this issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2026-28388)\n\nNathan Sportsman, Daniel Rhea, and Jaeho Nam discovered that OpenSSL\nincorrectly handled certain memory operations when processing a crafted CMS\nEnvelopedData message with KeyAgreeRecipientInfo. A remote attacker could\npossibly use this issue to cause OpenSSL to crash, resulting in a denial\nof service. (CVE-2026-28389)\n\nMuhammad Daffa, Joshua Rogers, and Chanho Kim discovered that OpenSSL\nincorrectly handled processing of a crafted CMS EnvelopedData message with\nKeyTransportRecipientInfo. A remote attacker could possibly use this issue\nto cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2026-28390)\n\nQuoc Tran discovered that OpenSSL incorrectly handled hexadecimal\nconversion on 32-bit platforms. A remote attacker could use this issue to\ncause OpenSSL to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-31789)\n\nSimo Sorce discovered that OpenSSL incorrectly handled failures in RSA KEM\nRSASVE Encapsulation. A remote attacker could possibly use this issue to\nobtain sensitive information. (CVE-2026-31790)","status":"published","published":"2026-04-08T11:57:32Z","modified":"2026-05-20T16:04:00.917390336Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}