{"id":"CVE-2026-28388","aliases":["ALPINE-CVE-2026-28388","AZL-81953","AZL-82100","BELL-CVE-2026-28388","CLSA-2026-1777297012","CLSA-2026-1777396609","CLSA-2026-1777999127","CLSA-2026-1778020035","CLSA-2026-1778020314","CLSA-2026-1778061272","CLSA-2026-1778071148","CLSA-2026-1778583971","CLSA-2026-1778787445","CLSA-2026-1779094874","CLSA-2026-1780682107","CLSA-2026-1780682108","CLSA-2026-1780683040","CLSA-2026-1785839292","CLSA-2026-1788860468","DEBIAN-CVE-2026-28388","EUVD-2026-19962","GHSA-rpg5-467j-c25q","JLSEC-2026-273","MGASA-2026-0091","OESA-2026-2041","OESA-2026-2042","OESA-2026-2043","OESA-2026-2044","OESA-2026-2045","OESA-2026-2078","OESA-2026-2079","OESA-2026-2080","OESA-2026-2081","OESA-2026-2082","OESA-2026-2189","OESA-2026-2190","OESA-2026-2191","OESA-2026-2619","OESA-2026-2620","OESA-2026-2621","OESA-2026-2622","RHSA-2026:7261","ROOT-OS-ALPINE-315-CVE-2026-28388","ROOT-OS-ALPINE-317-CVE-2026-28388","ROOT-OS-DEBIAN-11-CVE-2026-28388","SUSE-SU-2026:1213-1","SUSE-SU-2026:1214-1","SUSE-SU-2026:1215-1","SUSE-SU-2026:1216-1","SUSE-SU-2026:1255-1","SUSE-SU-2026:1256-1","SUSE-SU-2026:1257-1","SUSE-SU-2026:1290-1","SUSE-SU-2026:1291-1","SUSE-SU-2026:1375-1","SUSE-SU-2026:1386-1","SUSE-SU-2026:1577-1","SUSE-SU-2026:21037-1","SUSE-SU-2026:21065-1","SUSE-SU-2026:21107-1","SUSE-SU-2026:21186-1","SUSE-SU-2026:2396-1","SUSE-SU-2026:2399-1","UBUNTU-CVE-2026-28388","openSUSE-SU-2026:10533-1","openSUSE-SU-2026:20525-1"],"status":"published","title":"NULL Pointer Dereference When Processing a Delta CRL","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00919,"percentile":0.60563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-04-07T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.5-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.20-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.20-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-devel","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-libs","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-perl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-static","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-devel","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-libs","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-perl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-static","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-devel","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-libs","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-perl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-static","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl","fixed_in":["1:3.2.2-7.el9_6.tuxcare.1.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-devel","fixed_in":["1:3.2.2-7.el9_6.tuxcare.1.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-libs","fixed_in":["1:3.2.2-7.el9_6.tuxcare.1.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-perl","fixed_in":["1:3.2.2-7.el9_6.tuxcare.1.els11"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssl","fixed_in":["3.0.19-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.5-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.6.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"AppBundler","fixed_in":["1.0.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.0.20+0","3.5.6+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"shim","fixed_in":["15-41.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"shim","fixed_in":["15.6-30.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"shim","fixed_in":["15.7-26.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"shim","fixed_in":["15.7-26.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"shim","fixed_in":["15.7-26.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"openssl","fixed_in":["1.1.1w-r10073","1.1.1w-r10076","1.1.1w-r10074","1.1.1w-r10075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-openssl","fixed_in":["1.1.1w-r10073","1.1.1w-r10076","1.1.1w-r10074","1.1.1w-r10075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"openssl","fixed_in":["3.0.19-r00079","3.0.19-r00077","3.0.19-r00078"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-openssl","fixed_in":["3.0.19-r00079","3.0.19-r00077","3.0.19-r00078"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssl","fixed_in":["1.0.1f-1ubuntu2.27+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","fixed_in":["1.0.2g-1ubuntu4.20+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssl","fixed_in":["1.0.2g-1ubuntu4.fips.4.20.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","fixed_in":["1.0.2n-1ubuntu5.13+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssl","fixed_in":["1.1.1-1ubuntu2.fips.2.1~18.04.23.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssl","fixed_in":["1.1.1f-1ubuntu2.24+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"openssl","fixed_in":["1.1.1f-1ubuntu2.fips.24.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.23"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.23+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssl","fixed_in":["3.0.13-0ubuntu3.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","fixed_in":["3.0.13-0ubuntu3.12+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"openssl","fixed_in":["3.5.5-1ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl-fips-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.20-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.20-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libssl1.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els11"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els11"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els11"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els11"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl1.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl1.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl1.0.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1e-63.el6.tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1e-63.el6.tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1e-63.el6.tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1e-63.el6.tuxcare.els15"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.tuxcare.1.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.tuxcare.1.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.tuxcare.1.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.tuxcare.1.els11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-1~deb12u2"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.15-1~deb12u1","3.0.16-1~deb12u1","3.0.17-1~deb12u1","3.0.17-1~deb12u2","3.0.17-1~deb12u3","3.0.18-1~deb12u1","3.0.18-1~deb12u2","3.0.19-1~deb12u1","3.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3"]},{"source":"osv","ecosystem":"Julia","package":"AppBundler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.20+0"},{"introduced":"3.5.0+0"},{"fixed":"3.5.6+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-47.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-47.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-47.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-42.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1wa-16.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15-41.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-30.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-26.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-26.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-26.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-18.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-18.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-18.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-40.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-35.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-32.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-34.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-r10073"},{"fixed":"1.1.1w-r10076"},{"fixed":"1.1.1w-r10074"},{"fixed":"1.1.1w-r10075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-r10073"},{"fixed":"1.1.1w-r10076"},{"fixed":"1.1.1w-r10074"},{"fixed":"1.1.1w-r10075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r00079"},{"fixed":"3.0.19-r00077"},{"fixed":"3.0.19-r00078"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r00079"},{"fixed":"3.0.19-r00077"},{"fixed":"3.0.19-r00078"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.60.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.81.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.81.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.81.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.81.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.81.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.81.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.45.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.45.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.45.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.109.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.125.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.125.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.106.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.106.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.90.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.90.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.90.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.90.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.90.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.90.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.51.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.51.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.51.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.51.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.51.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.105.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.31.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150700.11.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150700.11.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150700.11.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.26.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.26.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-slfo.1.1_9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.109.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.109.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1f-1ubuntu2.27+esm13"}]}],"versions":["1.0.1e-3ubuntu1","1.0.1e-4ubuntu1","1.0.1e-4ubuntu2","1.0.1e-4ubuntu3","1.0.1e-4ubuntu4","1.0.1f-1ubuntu1","1.0.1f-1ubuntu2","1.0.1f-1ubuntu2.1","1.0.1f-1ubuntu2.2","1.0.1f-1ubuntu2.3","1.0.1f-1ubuntu2.4","1.0.1f-1ubuntu2.5","1.0.1f-1ubuntu2.7","1.0.1f-1ubuntu2.8","1.0.1f-1ubuntu2.11","1.0.1f-1ubuntu2.12","1.0.1f-1ubuntu2.15","1.0.1f-1ubuntu2.16","1.0.1f-1ubuntu2.17","1.0.1f-1ubuntu2.18","1.0.1f-1ubuntu2.19","1.0.1f-1ubuntu2.20","1.0.1f-1ubuntu2.21","1.0.1f-1ubuntu2.22","1.0.1f-1ubuntu2.23","1.0.1f-1ubuntu2.24","1.0.1f-1ubuntu2.25","1.0.1f-1ubuntu2.26","1.0.1f-1ubuntu2.27","1.0.1f-1ubuntu2.27+esm1","1.0.1f-1ubuntu2.27+esm2","1.0.1f-1ubuntu2.27+esm3","1.0.1f-1ubuntu2.27+esm4","1.0.1f-1ubuntu2.27+esm5","1.0.1f-1ubuntu2.27+esm6","1.0.1f-1ubuntu2.27+esm7","1.0.1f-1ubuntu2.27+esm9","1.0.1f-1ubuntu2.27+esm10","1.0.1f-1ubuntu2.27+esm11","1.0.1f-1ubuntu2.27+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.20+esm15"}]}],"versions":["1.0.2d-0ubuntu1","1.0.2d-0ubuntu2","1.0.2e-1ubuntu1","1.0.2f-2ubuntu1","1.0.2g-1ubuntu2","1.0.2g-1ubuntu3","1.0.2g-1ubuntu4","1.0.2g-1ubuntu4.1","1.0.2g-1ubuntu4.2","1.0.2g-1ubuntu4.4","1.0.2g-1ubuntu4.5","1.0.2g-1ubuntu4.6","1.0.2g-1ubuntu4.8","1.0.2g-1ubuntu4.9","1.0.2g-1ubuntu4.10","1.0.2g-1ubuntu4.11","1.0.2g-1ubuntu4.12","1.0.2g-1ubuntu4.13","1.0.2g-1ubuntu4.14","1.0.2g-1ubuntu4.15","1.0.2g-1ubuntu4.16","1.0.2g-1ubuntu4.17","1.0.2g-1ubuntu4.18","1.0.2g-1ubuntu4.19","1.0.2g-1ubuntu4.20","1.0.2g-1ubuntu4.20+esm1","1.0.2g-1ubuntu4.20+esm2","1.0.2g-1ubuntu4.20+esm3","1.0.2g-1ubuntu4.20+esm4","1.0.2g-1ubuntu4.20+esm5","1.0.2g-1ubuntu4.20+esm6","1.0.2g-1ubuntu4.20+esm7","1.0.2g-1ubuntu4.20+esm9","1.0.2g-1ubuntu4.20+esm10","1.0.2g-1ubuntu4.20+esm11","1.0.2g-1ubuntu4.20+esm12","1.0.2g-1ubuntu4.20+esm13","1.0.2g-1ubuntu4.20+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.fips.4.20.15"}]}],"versions":["1.0.2g-1ubuntu4.fips.4.9.1","1.0.2g-1ubuntu4.fips.4.13.1","1.0.2g-1ubuntu4.fips.4.15.1","1.0.2g-1ubuntu4.fips.4.16.1","1.0.2g-1ubuntu4.fips.4.17.1","1.0.2g-1ubuntu4.fips.4.18.1","1.0.2g-1ubuntu4.fips.4.19.3","1.0.2g-1ubuntu4.fips.4.20.1","1.0.2g-1ubuntu4.fips.4.20.2","1.0.2g-1ubuntu4.fips.4.20.3","1.0.2g-1ubuntu4.fips.4.20.6","1.0.2g-1ubuntu4.fips.4.20.7","1.0.2g-1ubuntu4.fips.4.20.9","1.0.2g-1ubuntu4.fips.4.20.10","1.0.2g-1ubuntu4.fips.4.20.11","1.0.2g-1ubuntu4.fips.4.20.12","1.0.2g-1ubuntu4.fips.4.20.13","1.0.2g-1ubuntu4.fips.4.20.14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2g-1ubuntu4.fips.4.6~ppa1","1.0.2g-1ubuntu4.fips.4.6~ppa2","1.0.2g-1ubuntu4.fips.4.6~ppa3","1.0.2g-1ubuntu4.fips.4.6","1.0.2g-1ubuntu4.fips.4.6.1","1.0.2g-1ubuntu4.fips.4.6.2","1.0.2g-1ubuntu4.fips.4.6.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+esm8"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5","1.1.1-1ubuntu2.1~18.04.6","1.1.1-1ubuntu2.1~18.04.7","1.1.1-1ubuntu2.1~18.04.8","1.1.1-1ubuntu2.1~18.04.9","1.1.1-1ubuntu2.1~18.04.10","1.1.1-1ubuntu2.1~18.04.13","1.1.1-1ubuntu2.1~18.04.14","1.1.1-1ubuntu2.1~18.04.15","1.1.1-1ubuntu2.1~18.04.17","1.1.1-1ubuntu2.1~18.04.19","1.1.1-1ubuntu2.1~18.04.20","1.1.1-1ubuntu2.1~18.04.21","1.1.1-1ubuntu2.1~18.04.22","1.1.1-1ubuntu2.1~18.04.23","1.1.1-1ubuntu2.1~18.04.23+esm1","1.1.1-1ubuntu2.1~18.04.23+esm3","1.1.1-1ubuntu2.1~18.04.23+esm4","1.1.1-1ubuntu2.1~18.04.23+esm5","1.1.1-1ubuntu2.1~18.04.23+esm6","1.1.1-1ubuntu2.1~18.04.23+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2n-1ubuntu5.13+esm4"}]}],"versions":["1.0.2n-1ubuntu2","1.0.2n-1ubuntu3","1.0.2n-1ubuntu4","1.0.2n-1ubuntu5","1.0.2n-1ubuntu5.1","1.0.2n-1ubuntu5.2","1.0.2n-1ubuntu5.3","1.0.2n-1ubuntu5.4","1.0.2n-1ubuntu5.5","1.0.2n-1ubuntu5.6","1.0.2n-1ubuntu5.7","1.0.2n-1ubuntu5.8","1.0.2n-1ubuntu5.9","1.0.2n-1ubuntu5.10","1.0.2n-1ubuntu5.11","1.0.2n-1ubuntu5.12","1.0.2n-1ubuntu5.13","1.0.2n-1ubuntu5.13+esm1","1.0.2n-1ubuntu5.13+esm2","1.0.2n-1ubuntu5.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.fips.2.1~18.04.23.8"}]}],"versions":["1.1.1-1ubuntu2.fips.2.1~18.04.5.1","1.1.1-1ubuntu2.fips.2.1~18.04.6.1","1.1.1-1ubuntu2.fips.2.1~18.04.7.1","1.1.1-1ubuntu2.fips.2.1~18.04.9.1","1.1.1-1ubuntu2.fips.2.1~18.04.9.2","1.1.1-1ubuntu2.fips.2.1~18.04.9.3","1.1.1-1ubuntu2.fips.2.1~18.04.13.2","1.1.1-1ubuntu2.fips.2.1~18.04.15","1.1.1-1ubuntu2.fips.2.1~18.04.15.1","1.1.1-1ubuntu2.fips.2.1~18.04.15.2","1.1.1-1ubuntu2.fips.2.1~18.04.17","1.1.1-1ubuntu2.fips.2.1~18.04.20","1.1.1-1ubuntu2.fips.2.1~18.04.21","1.1.1-1ubuntu2.fips.2.1~18.04.22","1.1.1-1ubuntu2.fips.2.1~18.04.23","1.1.1-1ubuntu2.fips.2.1~18.04.23.3","1.1.1-1ubuntu2.fips.2.1~18.04.23.4","1.1.1-1ubuntu2.fips.2.1~18.04.23.5","1.1.1-1ubuntu2.fips.2.1~18.04.23.6","1.1.1-1ubuntu2.fips.2.1~18.04.23.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1ubuntu2.fips.2.1~18.04.3.1","1.1.1-1ubuntu2.fips.2.1~18.04.15.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+esm3"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12","1.1.1f-1ubuntu2.13","1.1.1f-1ubuntu2.15","1.1.1f-1ubuntu2.16","1.1.1f-1ubuntu2.17","1.1.1f-1ubuntu2.18","1.1.1f-1ubuntu2.19","1.1.1f-1ubuntu2.20","1.1.1f-1ubuntu2.21","1.1.1f-1ubuntu2.22","1.1.1f-1ubuntu2.23","1.1.1f-1ubuntu2.24","1.1.1f-1ubuntu2.24+esm1","1.1.1f-1ubuntu2.24+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.fips.24.3"}]}],"versions":["1.1.1f-1ubuntu2.fips.7","1.1.1f-1ubuntu2.fips.7.2","1.1.1f-1ubuntu2.fips.12","1.1.1f-1ubuntu2.fips.13","1.1.1f-1ubuntu2.fips.13.1","1.1.1f-1ubuntu2.fips.16","1.1.1f-1ubuntu2.fips.17","1.1.1f-1ubuntu2.fips.18","1.1.1f-1ubuntu2.fips.19","1.1.1f-1ubuntu2.fips.20","1.1.1f-1ubuntu2.fips.21","1.1.1f-1ubuntu2.fips.22","1.1.1f-1ubuntu2.fips.24","1.1.1f-1ubuntu2.fips.24.1","1.1.1f-1ubuntu2.fips.24.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1f-1ubuntu2.fips.2.8","1.1.1f-1ubuntu2.fips.7.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3","2022.02-3ubuntu0.22.04.4","2022.02-3ubuntu0.22.04.5","2022.02-3ubuntu0.22.04.6","2022.02-3ubuntu0.22.04.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.23"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.23+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1","3.0.2-0ubuntu1.17+Fips1","3.0.2-0ubuntu1.18+Fips1","3.0.2-0ubuntu1.19+Fips1","3.0.2-0ubuntu1.20+Fips1","3.0.2-0ubuntu1.21+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5","2024.02-2ubuntu0.6","2024.02-2ubuntu0.7","2024.02-2ubuntu0.8","2024.02-2ubuntu0.9","2024.02-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.9"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.12+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1","3.0.13-0ubuntu3.6+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7}],"products":[{"vendor":"openssl","product":"openssl"},{"vendor":"siemens","product":"simatic cn 4100"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web","article"]},{"url":"https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","tags":["patch","Patch","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rpg5-467j-c25q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-28388","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-28388","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1777297012.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1777396609.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1777999127.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778020035.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1778020314.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1778061272.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778071148.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778583971.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1778787445.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779094874.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1780682107.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1780682108.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780683040.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1785839292.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788860468.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28388.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-28388","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0091.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35331","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/07/11","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2042","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2043","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2044","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2045","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2078","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2079","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2080","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2081","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2082","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2190","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2191","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2619","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2620","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2621","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2622","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7261","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9232","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69421","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69420","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69419","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69418","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68160","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15467","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31790","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2673","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22796","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7261.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9231","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11187","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430376","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15469","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66199","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69419","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69421","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2673","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260313.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22795","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28386","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28388","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31789","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31790","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260441","tags":["report"]},{"url":"https://bugzilla.suse.com/1260442","tags":["report"]},{"url":"https://bugzilla.suse.com/1260443","tags":["report"]},{"url":"https://bugzilla.suse.com/1260444","tags":["report"]},{"url":"https://bugzilla.suse.com/1260445","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31790","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261214-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261215-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261216-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261255-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261256-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261257-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261290-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261291-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261375-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28390","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261386-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261577-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621037-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621107-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259652","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2673","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621186-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262396-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260446","tags":["report"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262399-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-28388","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8155-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8155-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-28388","title":"NULL Pointer Dereference When Processing a Delta CRL","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:00:52.382Z","modified":"2026-10-15T01:15:33.077Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:20:01.969981Z"}],"euvd":[{"id":"EUVD-2026-19962","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:00:52Z","modified":"2026-10-15T01:15:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:06.52614Z"}],"ghsa":[{"id":"GHSA-rpg5-467j-c25q","title":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL...","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-08T00:30:25Z","modified":"2026-05-12T15:31:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:08:03.879292Z"}],"nvd":[{"id":"CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:20.863Z","modified":"2026-07-24T23:10:00.563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"ALPINE-CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:20.863Z","modified":"2026-10-01T02:17:49.22555351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-28388","status":"published","published":"2026-04-09T01:49:02.138145Z","modified":"2026-04-22T07:15:46.571358Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-28388","title":"NULL Pointer Dereference When Processing a Delta CRL","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:00:52.382Z","modified":"2026-10-28T11:10:06.414068997Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.  Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.  When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.  Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.  The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.  The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:20.863Z","modified":"2026-10-01T03:02:33.488071105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"JLSEC-2026-273","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the `X509_V_FLAG_USE_DELTAS` flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the `EXFLAG_FRESHEST` flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-08-13T13:00:04.795585316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2041","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)\n\nIssue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.(CVE-2026-31790)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:56.494969704Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2042","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)\n\nIssue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.(CVE-2026-31790)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:44.594600507Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2043","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)\n\nIssue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.(CVE-2026-31790)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:56.441268425Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2044","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:56.342776511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2045","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:49.308515463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2078","title":"shim security update","description":"Initial UEFI bootloader that handles chaining to a trusted full \\ bootloader under secure boot environments.\r\n\r\nSecurity Fix(es):\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:56.442309083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2079","title":"shim security update","description":"Initial UEFI bootloader that handles chaining to a trusted full \\ bootloader under secure boot environments.\r\n\r\nSecurity Fix(es):\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:56.347312315Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2080","title":"shim security update","description":"Initial UEFI bootloader that handles chaining to a trusted full \\ bootloader under secure boot environments.\r\n\r\nSecurity Fix(es):\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:56.293460264Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2081","title":"shim security update","description":"Initial UEFI bootloader that handles chaining to a trusted full \\ bootloader under secure boot environments.\r\n\r\nSecurity Fix(es):\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:56.343318893Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2082","title":"shim security update","description":"Initial UEFI bootloader that handles chaining to a trusted full \\ bootloader under secure boot environments.\r\n\r\nSecurity Fix(es):\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:56.331614724Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2189","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:50.936078875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2190","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:51.819303807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2191","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:50.918351295Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2619","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:03.840404273Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2620","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:03.88877115Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2621","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:04.137132866Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2622","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:03.726471239Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:7261","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:08Z","modified":"2026-10-20T10:15:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-28388","title":"CVE-2026-28388 in openssl - Patched by Root","description":"Root has patched CVE-2026-28388 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-10-13T15:12:42Z","modified":"2026-10-13T16:15:37.944864734Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2026-28388","title":"CVE-2026-28388 in openssl - Patched by Root","description":"Root has patched CVE-2026-28388 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-10-15T06:28:37Z","modified":"2026-10-15T07:15:05.808714297Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-28388","title":"CVE-2026-28388 in rootio-openssl - Patched by Root","description":"Root has patched CVE-2026-28388 in the rootio-openssl package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2026-04-13T07:07:10Z","modified":"2026-08-21T14:00:14.280424783Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"UBUNTU-CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-10-17T12:58:08.42433676Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-81953","title":"CVE-2026-28388 affecting package openssl for versions less than 3.3.5-5","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:20Z","modified":"2026-08-28T17:56:49.151165Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"AZL-82100","title":"CVE-2026-28388 affecting package openssl-fips-provider 3.1.2-2","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:20Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1777297012","title":"openssl: Fix of 3 CVEs","description":"- CVE-2026-28388: fix NULL dereference in check_delta_base() when a\n  Delta CRL lacks the CRL Number extension\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n  when KeyEncryptionAlgorithmIdentifier has no parameters field\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt() when the\n  pSourceFunc X509_ALGOR has no parameters field","status":"published","published":"2026-04-27T13:36:57Z","modified":"2026-06-01T00:32:38.163319975Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777396609","title":"openssl: Fix of 3 CVEs","description":"- CVE-2026-28388: fix NULL dereference in check_delta_base() when a\n  Delta CRL lacks the CRL Number extension\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n  when KeyEncryptionAlgorithmIdentifier has no parameters field\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt() when the\n  pSourceFunc X509_ALGOR has no parameters field","status":"published","published":"2026-04-28T17:16:55Z","modified":"2026-06-01T00:33:23.583878347Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777999127","title":"Fix CVE(s): CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390","description":"   * SECURITY UPDATE: fix UAF/double-free in DANE client by using X509_free() for dane-\u003emcert\n     - debian/patches/CVE-2026-28387.patch: fix UAF/double-free in DANE client by using X509_free() for dane-\u003emcert\n     - CVE-2026-28387\n   * SECURITY UPDATE: NULL check delta-\u003ecrl_number before ASN1_INTEGER_cmp() in check_delta_base()\n     - debian/patches/CVE-2026-28388.patch: NULL check delta-\u003ecrl_number before ASN1_INTEGER_cmp() in check_delta_base()\n     - CVE-2026-28388\n   * SECURITY UPDATE: NULL check alg-\u003eparameter in [ec]dh_cms_set_shared_info() before deref\n     - debian/patches/CVE-2026-28389.patch: NULL check alg-\u003eparameter in [ec]dh_cms_set_shared_info() before deref\n     - CVE-2026-28389\n   * SECURITY UPDATE: NULL check plab-\u003eparameter in rsa_cms_decrypt() before deref\n     - debian/patches/CVE-2026-28390.patch: NULL check plab-\u003eparameter in rsa_cms_decrypt() before deref\n     - CVE-2026-28390","status":"published","published":"2026-05-05T16:38:52Z","modified":"2026-06-04T10:03:49.102715Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778020035","title":"openssl: Fix of CVE-2026-28388","description":"- CVE-2026-28388: fix NULL pointer dereference in check_delta_base() when delta\n  CRL lacks CRL Number extension","status":"published","published":"2026-05-05T22:27:21Z","modified":"2026-06-01T00:33:14.11460269Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778020314","title":"openssl: Fix of CVE-2026-28388","description":"- CVE-2026-28388: fix NULL pointer dereference in check_delta_base() when delta\n  CRL lacks CRL Number extension","status":"published","published":"2026-05-05T22:32:01Z","modified":"2026-06-01T00:33:28.305612873Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778061272","title":"openssl: Fix of CVE-2026-28388","description":"- CVE-2026-28388: fix NULL pointer dereference in check_delta_base() when delta\n  CRL lacks CRL Number extension","status":"published","published":"2026-05-08T11:47:24Z","modified":"2026-06-01T00:33:18.77773206Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778071148","title":"openssl: Fix of 5 CVEs","description":"- CVE-2026-28387: fix use of OPENSSL_free instead of X509_free on\n  dane-\u003emcert in dane_match() (X509 reference-count bypass / UAF)\n- CVE-2026-28388: fix NULL deref in check_delta_base when a delta CRL\n  carries the Delta CRL Indicator extension but lacks a CRL Number\n- CVE-2026-28389: fix NULL deref in dh_cms_set_shared_info /\n  ecdh_cms_set_shared_info on absent CMS KARI parameters\n- CVE-2026-31789: fix integer overflow in OPENSSL_buf2hexstr causing\n  heap OOB write when converting \u003e SIZE_MAX/3 bytes (32-bit builds)","status":"published","published":"2026-10-22T00:26:53Z","modified":"2026-10-26T09:30:06.565234275Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778583971","title":"Fix CVE(s): CVE-2026-28387, CVE-2026-28388","description":"   * SECURITY UPDATE: A use-after-free / heap corruption in dane_match() of\n     the X.509 verifier where the cached DANE-matched certificate was freed\n     via OPENSSL_free() instead of X509_free(), bypassing the X509 reference\n     counting and freeing certificate fields that may still be referenced by\n     other holders. An attacker able to influence the DANE TLSA records used\n     during certificate verification can trigger memory corruption.\n     - debian/patches/CVE-2026-28387.patch: replace OPENSSL_free(dane-\u003emcert)\n       with X509_free(dane-\u003emcert) in dane_match() in crypto/x509/x509_vfy.c.\n     - CVE-2026-28387\n   * SECURITY UPDATE: A NULL pointer dereference in check_delta_base() of\n     the X.509 CRL verifier when a delta CRL lacks the CRL Number extension.\n     A remote attacker controlling a delta CRL can trigger a crash, leading\n     to Denial of Service in applications using -crl_check with -use_deltas.\n     - debian/patches/CVE-2026-28388.patch: NULL-check delta-\u003ecrl_number\n       before passing it to ASN1_INTEGER_cmp() in check_delta_base() in\n       crypto/x509/x509_vfy.c, and ship the upstream test fixtures and\n       verify recipe.\n     - CVE-2026-28388","status":"published","published":"2026-05-12T11:06:16Z","modified":"2026-06-04T10:03:23.502771Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778787445","title":"Fix CVE(s): CVE-2026-28387, CVE-2026-28388, CVE-2026-28389","description":"   * SECURITY UPDATE: Use-after-free / heap corruption in dane_match() of\n     the X.509 verifier where the cached DANE-matched certificate was freed\n     via OPENSSL_free() instead of X509_free(), bypassing the X509 reference\n     counting and freeing certificate fields that may still be referenced by\n     other holders. An attacker able to influence the DANE TLSA records used\n     during certificate verification can trigger memory corruption.\n     - debian/patches/CVE-2026-28387.patch: replace OPENSSL_free(dane-\u003emcert)\n       with X509_free(dane-\u003emcert) in dane_match() in crypto/x509/x509_vfy.c.\n     - CVE-2026-28387\n   * SECURITY UPDATE: NULL pointer dereference in check_delta_base() of\n     the X.509 CRL verifier when a delta CRL lacks the CRL Number extension.\n     A remote attacker controlling a delta CRL can trigger a crash, leading\n     to denial of service in applications using -crl_check with -use_deltas.\n     - debian/patches/CVE-2026-28388.patch: NULL-check delta-\u003ecrl_number\n       before passing it to ASN1_INTEGER_cmp() in check_delta_base() in\n       crypto/x509/x509_vfy.c, and ship the upstream test fixtures and\n       verify recipe.\n     - CVE-2026-28388\n   * SECURITY UPDATE: NULL pointer dereference in dh_cms_set_shared_info()\n     and ecdh_cms_set_shared_info() when a CMS KeyAgreeRecipientInfo has\n     no KeyEncryptionAlgorithmIdentifier parameters field, allowing a\n     remote attacker to trigger a denial of service via crafted CMS data.\n     - debian/patches/CVE-2026-28389.patch: NULL-check alg-\u003eparameter\n       before accessing its type in crypto/dh/dh_ameth.c and\n       crypto/ec/ec_ameth.c.\n     - CVE-2026-28389","status":"published","published":"2026-05-14T22:19:12Z","modified":"2026-06-04T10:04:07.449288Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779094874","title":"Fix CVE(s): CVE-2026-28388, CVE-2026-28389","description":"   * SECURITY UPDATE: NULL pointer dereference in check_delta_base() when a\n     delta CRL is processed without the required CRL Number extension and\n     X509_V_FLAG_USE_DELTAS is enabled, leading to a denial of service.\n     - debian/patches/CVE-2026-28388.patch: add NULL check for\n       delta-\u003ecrl_number before ASN1_INTEGER_cmp() in check_delta_base()\n     - CVE-2026-28388\n   * SECURITY UPDATE: NULL pointer dereference in dh_cms_set_shared_info()\n     and ecdh_cms_set_shared_info() when a CMS EnvelopedData message uses\n     KeyAgreeRecipientInfo with a KeyEncryptionAlgorithmIdentifier whose\n     optional parameter field is omitted, leading to a denial of service.\n     - debian/patches/CVE-2026-28389.patch: check alg-\u003eparameter for NULL\n       before accessing its type field in dh_cms_set_shared_info() and\n       ecdh_cms_set_shared_info()\n     - CVE-2026-28389","status":"published","published":"2026-05-18T09:01:19Z","modified":"2026-06-04T10:04:19.836829Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1780682107","title":"openssl11: Fix of 10 CVEs","description":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","status":"published","published":"2026-10-19T20:44:42Z","modified":"2026-10-26T09:43:19.372450535Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780682108","title":"openssl11: Fix of 10 CVEs","description":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","status":"published","published":"2026-10-19T20:30:57Z","modified":"2026-10-26T09:43:24.553701582Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780683040","title":"openssl11: Fix of 10 CVEs","description":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","status":"published","published":"2026-10-19T20:23:13Z","modified":"2026-10-26T09:43:24.002329629Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1785839292","title":"openssl: Fix of 5 CVEs","description":"- CVE-2026-7383: fix signed integer overflow when sizing Unicode output in ASN1_mbstring_ncopy()\n- CVE-2026-9076: fix heap out-of-bounds read in kek_unwrap_key() check-byte validation\n- CVE-2026-28388: fix NULL pointer dereference when delta CRL lacks the CRL Number extension\n- CVE-2026-34180: avoid length truncation in ASN1_STRING_set() when called from asn1_ex_c2i()\n- CVE-2026-42766: fix NULL dereference when keyDerivationAlgorithm is absent in CMS PasswordRecipientInfo","status":"published","published":"2026-08-06T14:56:02Z","modified":"2026-10-26T09:43:26.071297956Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1788860468","title":"openssl: Fix of CVE-2026-28388","description":"- CVE-2026-28388: check that a delta CRL carries a CRL Number extension before\n  dereferencing it in check_delta_base(); prevents a NULL pointer dereference\n  and denial of service when a malformed delta CRL is processed","status":"published","published":"2026-09-08T09:41:17Z","modified":"2026-10-26T09:31:35.68842043Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0091","title":"Updated openssl packages fix security vulnerabilities","description":"Incorrect Failure Handling in RSA KEM RSASVE Encapsulation.\n(CVE-2026-31790)\nPotential Use-after-free in DANE Client Code. (CVE-2026-28387)\nNULL Pointer Dereference When Processing a Delta CRL. (CVE-2026-28388)\nPossible NULL Dereference When Processing CMS KeyAgreeRecipientInfo.\n(CVE-2026-28389)\nPossible NULL Dereference When Processing CMS KeyTransportRecipientInfo.\n(CVE-2026-28390)\nHeap Buffer Overflow in Hexadecimal Conversion. (CVE-2026-31789)\n","status":"published","published":"2026-04-10T17:11:05Z","modified":"2026-04-16T04:43:10.881651652Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10533-1","title":"libopenssl-3-devel-3.5.3-4.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-11T00:00:00Z","modified":"2026-04-12T10:18:35.053653Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20525-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).\n- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with\n  KeyTransportRecipientInfo (bsc#1261678).\n- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n\nOther updates and bugfixes:\n\n- Enable MD2 in legacy provider (jsc#PED-15724).\n","status":"published","published":"2026-04-13T15:48:00Z","modified":"2026-04-22T18:26:40.507754Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1213-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2026-28387: Potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL (bsc#1260442).\n- CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-31789: Heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n","status":"published","published":"2026-04-08T12:27:10Z","modified":"2026-04-09T08:00:44.083343Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1214-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2026-28387: Potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL (bsc#1260442).\n- CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-31789: Heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n","status":"published","published":"2026-04-08T12:27:45Z","modified":"2026-04-09T08:00:58.331583Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1215-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2026-28387: Potential use-after-free in DANE client code (bsc#1260441).\n- CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL (bsc#1260442).\n- CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).\n- CVE-2026-31789: Heap buffer overflow in hexadecimal conversion (bsc#1260444).\n- CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).\n","status":"published","published":"2026-04-08T12:27:58Z","modified":"2026-04-09T08:00:31.16948Z","updated_at":"2026-11-02T15:54:01.262144Z"}]},"sources_more":{"osv":15}}