{"id":"CVE-2026-34181","aliases":["ALPINE-CVE-2026-34181","ALSA-2026:25237","ALSA-2026:25239","BELL-CVE-2026-34181","DEBIAN-CVE-2026-34181","EUVD-2026-35477","GHSA-4jgc-cj59-f9mm","JLSEC-2026-1134","MGASA-2026-0253","RHSA-2026:25237","RHSA-2026:25239","RHSA-2026:42825","RHSA-2026:55543","RHSA-2026:59635","RHSA-2026:59641","RHSA-2026:62562","RHSA-2026:62563","RHSA-2026:62790","RHSA-2026:67551","RLSA-2026:25237","RLSA-2026:25239","SUSE-SU-2026:23463-1","SUSE-SU-2026:23609-1","SUSE-SU-2026:2648-1","SUSE-SU-2026:4039-1","UBUNTU-CVE-2026-34181","openSUSE-SU-2026:11623-1","openSUSE-SU-2026:21744-1"],"status":"published","title":"PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00376,"percentile":0.31941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-354"],"published":"2026-06-09T00:00:00Z","modified":"2026-10-29T11:32:34Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.6-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.6.3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"AppBundler","fixed_in":["1.0.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.5.7+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.6-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.3-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3","3.6.2-1"]},{"source":"osv","ecosystem":"Julia","package":"AppBundler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0+0"},{"fixed":"3.5.7+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.203+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1.mga10"}]}],"bundled":15},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-1.mga9"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"chunkah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:50.0.0-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:50.0.0-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-fips-provider-upstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.20.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.3.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.9-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.3.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.4-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.5-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bootupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-bootupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.36.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150700.5.50.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.4"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3","3.5.3-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.2"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-8.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.10.1"}]}],"bundled":11}],"products":[{"vendor":"openssl","product":"openssl"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260609.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34181","tags":["advisory","web"]},{"url":"https://github.com/openssl/security/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f","tags":["web"]},{"url":"https://github.com/openssl/security/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610","tags":["web"]},{"url":"https://github.com/openssl/security/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7","tags":["web"]},{"url":"https://github.com/openssl/security/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4jgc-cj59-f9mm","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34181","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25237","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34180","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34181","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34182","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34183","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42764","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42766","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42767","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42768","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42769","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42770","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45445","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45446","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45447","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9076","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481879","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481880","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481881","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481882","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481887","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481890","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481891","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481892","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481893","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481894","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481896","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481898","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-25237.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25239","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-25239.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-34181","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34181.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34181","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35662","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/15","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8414-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00245.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6FSVWKLYXUHNRSEKJHJA6OVPW64N45U/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YTQ27HDP33LD6AS24REY2JEVD6LKVTQQ/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25237.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34181","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34183","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42764","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42767","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42768","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42769","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42770","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45445","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45446","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25239.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42825","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54876","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75803","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42765","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42771","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35188","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42825.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35188","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42771","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511600","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54876","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260805.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260825.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93599","tags":["advisory"]},{"url":"https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69248","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69249","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69247","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84782","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55543.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69247","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/15369","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510830","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69248","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/14888","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69249","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/14960","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","tags":["advisory"]},{"url":"https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14457","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63076","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63075","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54874","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18798","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59635.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517562","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14457","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517561","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59641","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84783","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59641.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260929.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62562","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80213","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62562.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80212","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea","tags":["article"]},{"url":"https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80213","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/b336e42d6a3e2a824308f7b47fa26a968641b366","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62563","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62563.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62790","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62790.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67551.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25237","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25239","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623463-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266343","tags":["report"]},{"url":"https://bugzilla.suse.com/1274774","tags":["report"]},{"url":"https://bugzilla.suse.com/1274777","tags":["report"]},{"url":"https://bugzilla.suse.com/1274788","tags":["report"]},{"url":"https://bugzilla.suse.com/1274790","tags":["report"]},{"url":"https://bugzilla.suse.com/1274791","tags":["report"]},{"url":"https://bugzilla.suse.com/1274792","tags":["report"]},{"url":"https://bugzilla.suse.com/1274795","tags":["report"]},{"url":"https://bugzilla.suse.com/1274796","tags":["report"]},{"url":"https://bugzilla.suse.com/1274797","tags":["report"]},{"url":"https://bugzilla.suse.com/1274798","tags":["report"]},{"url":"https://bugzilla.suse.com/1275837","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75803","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623609-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262648-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266345","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266350","tags":["report"]},{"url":"https://bugzilla.suse.com/1266351","tags":["report"]},{"url":"https://bugzilla.suse.com/1266352","tags":["report"]},{"url":"https://bugzilla.suse.com/1266353","tags":["report"]},{"url":"https://bugzilla.suse.com/1266355","tags":["report"]},{"url":"https://bugzilla.suse.com/1266356","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264039-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34181","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34181","title":"PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T16:03:22.065Z","modified":"2026-06-10T16:02:19.675Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-35477","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T16:03:22Z","modified":"2026-06-10T16:02:19Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:45.405546Z"}],"ghsa":[{"id":"GHSA-4jgc-cj59-f9mm","title":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files...","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T18:30:42Z","modified":"2026-06-10T18:32:45Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T15:08:43.963781Z"}],"nvd":[{"id":"CVE-2026-34181","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:04.74Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:12:23.109705Z"}],"osv":[{"id":"ALPINE-CVE-2026-34181","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:04.74Z","modified":"2026-10-01T02:17:49.252903855Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-34181","status":"published","published":"2026-06-10T13:01:30.245075Z","modified":"2026-06-16T07:15:05.008187946Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-34181","title":"PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T16:03:22.065Z","modified":"2026-11-11T10:47:28.941274041Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-354"],"updated_at":"2026-11-11T11:06:44.414983Z"},{"id":"DEBIAN-CVE-2026-34181","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery.  Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability.  If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker.  The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:04.74Z","modified":"2026-10-01T03:02:37.400150247Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-1134","title":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files...","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","status":"published","published":"2026-08-03T19:08:57.739Z","modified":"2026-08-13T13:00:04.755190263Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2026:25237","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-12T10:07:07Z","modified":"2026-10-20T10:06:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25239","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-12T10:07:08Z","modified":"2026-10-20T10:06:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:42825","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-29T10:05:47Z","modified":"2026-10-20T10:09:07Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:55543","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-29T10:06:17Z","modified":"2026-10-20T10:11:20Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59635","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:54Z","modified":"2026-10-20T10:12:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59641","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:54Z","modified":"2026-10-20T10:12:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62562","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-03T10:14:27Z","modified":"2026-10-20T10:12:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62563","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-03T10:14:28Z","modified":"2026-10-20T10:12:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62790","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:08Z","modified":"2026-10-20T10:12:46Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67551","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:18:42Z","modified":"2026-10-20T10:13:58Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:25237","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n\n* openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n\n* openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n\n* openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n\n* openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n\n* openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n\n* openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n\n* openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n\n* openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n\n* openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n\n* openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:05:06.020189Z","modified":"2026-06-13T00:30:05.753476822Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25239","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n\n* openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n\n* openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n\n* openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n\n* openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n\n* openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n\n* openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n\n* openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n\n* openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n\n* openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n\n* openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:03:17.085789Z","modified":"2026-06-13T00:30:05.7593994Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-34181","description":"Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T00:00:00Z","modified":"2026-10-17T13:00:01.412188309Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:25237","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:30:19.406512767Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25239","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:32:34.006971149Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"MGASA-2026-0253","title":"Updated openssl packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nPossible Heap Buffer Overflow in ASN.1 Multibyte String Conversion.\n(CVE-2026-7383)\nOut-of-Bounds Read in CMS Password-Based Decryption. (CVE-2026-9076)\nHeap Buffer Over-read in ASN.1 Content Parsing. (CVE-2026-34180)\nPKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys.\n(CVE-2026-34181)\nCMS AuthEnvelopedData Processing May Accept Forged Messages.\n(CVE-2026-34182)\nUnbounded Memory Growth in the QUIC PATH_CHALLENGE Handler.\n(CVE-2026-34183)\nNULL Pointer Dereference in QUIC Server Initial Packet Handling.\n(CVE-2026-42764)\nPossible NULL Dereference in Password-Based CMS Decryption.\n(CVE-2026-42766)\nNULL Pointer Dereference in CRMF EncryptedValue Decryption.\n(CVE-2026-42767)\nMulti-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and\nPKCS7_decrypt(). (CVE-2026-42768)\nTrust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate.\n(CVE-2026-42769)\nFFC-DH Peer Validation Uses Attacker-Supplied q. (CVE-2026-42770)\nAES-OCB IV Ignored on EVP_Cipher() Path. (CVE-2026-45445)\nIncorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV\nmodes. (CVE-2026-45446)\nHeap Use-After-Free in the PKCS7_verify(). (CVE-2026-45447)\n","status":"published","published":"2026-07-15T17:33:12Z","modified":"2026-07-15T17:49:59.909323566Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11623-1","title":"libopenssl-3-devel-3.5.3-8.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-08-28T18:23:08.790866431Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21744-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nAugust 2026 release.\n\n- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).\n- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).\n- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).\n- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).\n- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).\n- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).\n- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).\n- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).\n- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).\n- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).\n- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).\n","status":"published","published":"2026-09-02T15:55:21Z","modified":"2026-09-09T18:23:13.577661775Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23463-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nAugust 2026 release.\n\n- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).\n- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).\n- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).\n- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).\n- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).\n- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).\n- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).\n- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).\n- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).\n- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).\n- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).\n","status":"published","published":"2026-09-02T15:59:12Z","modified":"2026-09-14T18:23:12.065783412Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23609-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nAugust 2026 release.\n\n- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).\n- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).\n- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).\n- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).\n- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).\n- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).\n- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).\n- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).\n- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).\n- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).\n- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).\n","status":"published","published":"2026-09-02T15:59:12Z","modified":"2026-09-29T18:23:19.207612323Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:2648-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-26T11:06:32Z","modified":"2026-06-27T08:45:05.198594059Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4039-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nAugust 2026 release.\n  \n- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).\n- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).\n- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).\n- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).\n- CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).\n- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).\n- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).\n- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).\n- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).\n- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).\n- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).\n","status":"published","published":"2026-09-07T08:29:17Z","modified":"2026-09-13T18:23:17.356459762Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}