{"id":"CVE-2026-34183","aliases":["ALPINE-CVE-2026-34183","ALSA-2026:25237","ALSA-2026:25239","AZL-89925","BELL-CVE-2026-34183","DEBIAN-CVE-2026-34183","EUVD-2026-35479","GHSA-f5vx-f6jp-89j6","JLSEC-2026-1136","MGASA-2026-0253","RHSA-2026:25237","RHSA-2026:25239","RHSA-2026:42825","RHSA-2026:55543","RHSA-2026:59635","RHSA-2026:59641","RHSA-2026:62562","RHSA-2026:62563","RHSA-2026:62790","RHSA-2026:67551","RHSA-2026:71542","RHSA-2026:83617","RLSA-2026:25237","RLSA-2026:25239","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","SUSE-SU-2026:2648-1","UBUNTU-CVE-2026-34183","openSUSE-SU-2026:11023-1","openSUSE-SU-2026:21005-1"],"status":"published","title":"Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01049,"percentile":0.64497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1325"],"published":"2026-06-09T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.7-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.6-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.6.3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"AppBundler","fixed_in":["1.0.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.5.7+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.3.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.6-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.3-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3","3.6.2-1"]},{"source":"osv","ecosystem":"Julia","package":"AppBundler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0+0"},{"fixed":"3.5.7+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.203+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1.mga10"}]}],"bundled":15},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-1.mga9"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"chunkah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:50.0.0-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:50.0.0-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-fips-provider-upstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.20.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.3.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.9-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.3.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.4-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.5-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bootupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-bootupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.36.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.4"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3","3.5.3-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.2"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15}],"products":[{"vendor":"openssl","product":"openssl"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260609.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34183","tags":["web","advisory"]},{"url":"https://github.com/openssl/security/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","tags":["web"]},{"url":"https://github.com/openssl/security/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","tags":["web"]},{"url":"https://github.com/openssl/security/commit/d2e9efbe4900a373227deb136e8665401404ffac","tags":["web"]},{"url":"https://github.com/openssl/security/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f5vx-f6jp-89j6","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34183","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25237","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34180","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34181","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34182","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34183","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42764","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42766","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42767","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42768","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42769","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42770","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45445","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45446","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45447","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9076","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481879","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481880","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481881","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481882","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481887","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481890","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481891","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481892","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481893","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481894","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481896","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481898","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-25237.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25239","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-25239.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-34183","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34183.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34183","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35662","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/15","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8414-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00245.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6FSVWKLYXUHNRSEKJHJA6OVPW64N45U/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YTQ27HDP33LD6AS24REY2JEVD6LKVTQQ/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25237.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34181","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34183","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42764","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42767","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42768","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42769","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42770","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45445","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45446","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25239.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42825","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54876","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75803","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42765","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42771","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35188","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42825.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35188","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42771","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511600","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54876","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260805.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260825.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93599","tags":["advisory"]},{"url":"https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69248","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69249","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69247","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84782","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55543.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69247","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/15369","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510830","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69248","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/14888","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69249","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/14960","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","tags":["advisory"]},{"url":"https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14457","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63076","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63075","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54874","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18798","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59635.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517562","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14457","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517561","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59641","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84783","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59641.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260929.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62562","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80213","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62562.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80212","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea","tags":["article"]},{"url":"https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80213","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/b336e42d6a3e2a824308f7b47fa26a968641b366","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62563","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62563.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62790","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62790.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67551.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71542","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71542.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31790","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83617","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83617.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25237","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25239","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622251-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259652","tags":["report"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266344","tags":["report"]},{"url":"https://bugzilla.suse.com/1266345","tags":["report"]},{"url":"https://bugzilla.suse.com/1266347","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266350","tags":["report"]},{"url":"https://bugzilla.suse.com/1266351","tags":["report"]},{"url":"https://bugzilla.suse.com/1266352","tags":["report"]},{"url":"https://bugzilla.suse.com/1266353","tags":["report"]},{"url":"https://bugzilla.suse.com/1266355","tags":["report"]},{"url":"https://bugzilla.suse.com/1266356","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622315-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262648-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266343","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34181","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-34183","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34183","title":"Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T16:03:23.623Z","modified":"2026-06-10T15:51:12.557Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1325"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-35479","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T16:03:23Z","modified":"2026-06-10T15:51:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:45.405546Z"}],"ghsa":[{"id":"GHSA-f5vx-f6jp-89j6","title":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it...","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T18:30:41Z","modified":"2026-06-10T18:31:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1325"],"updated_at":"2026-11-02T15:08:43.963781Z"}],"nvd":[{"id":"CVE-2026-34183","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T17:17:05Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1325"],"updated_at":"2026-11-02T14:12:23.109705Z"}],"osv":[{"id":"ALPINE-CVE-2026-34183","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T17:17:05Z","modified":"2026-10-01T02:17:49.25360823Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-34183","status":"published","published":"2026-06-10T13:01:30.714708Z","modified":"2026-06-16T07:15:05.022648331Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-34183","title":"Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T16:03:23.623Z","modified":"2026-10-28T11:12:08.095269959Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1325"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34183","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.  Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.  A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.  The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:05Z","modified":"2026-10-01T03:03:11.056752612Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-1136","title":"Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it...","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing `PATH_CHALLENGE`\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with `PATH_CHALLENGE` frames. The local QUIC stack\nallocates a `PATH_RESPONSE` frame for every `PATH_CHALLENGE` it receives.\nThe allocated `PATH_RESPONSE` frame gets freed only when the remote\npeer acknowledges reception of the `PATH_RESPONSE` frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-08-03T19:08:57.739Z","modified":"2026-08-13T13:00:06.119707359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2026:25237","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-12T10:07:07Z","modified":"2026-10-20T10:06:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25239","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-12T10:07:08Z","modified":"2026-10-20T10:06:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:42825","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-29T10:05:47Z","modified":"2026-10-20T10:09:07Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:55543","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-29T10:06:17Z","modified":"2026-10-20T10:11:20Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59635","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:54Z","modified":"2026-10-20T10:12:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59641","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:54Z","modified":"2026-10-20T10:12:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62562","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-03T10:14:27Z","modified":"2026-10-20T10:12:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62563","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-03T10:14:28Z","modified":"2026-10-20T10:12:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62790","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:08Z","modified":"2026-10-20T10:12:46Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67551","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:18:42Z","modified":"2026-10-20T10:13:58Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:71542","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-09-25T10:15:28Z","modified":"2026-10-20T10:14:55Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:83617","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-10-16T10:27:34Z","modified":"2026-10-20T10:17:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:25237","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n\n* openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n\n* openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n\n* openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n\n* openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n\n* openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n\n* openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n\n* openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n\n* openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n\n* openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n\n* openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:05:06.020189Z","modified":"2026-06-13T00:30:05.753476822Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25239","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n\n* openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n\n* openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n\n* openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n\n* openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n\n* openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n\n* openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n\n* openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n\n* openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n\n* openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n\n* openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:03:17.085789Z","modified":"2026-06-13T00:30:05.7593994Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-34183","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T00:00:00Z","modified":"2026-10-17T13:00:00.818470916Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:25237","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:30:19.406512767Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25239","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:32:34.006971149Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-89925","title":"CVE-2026-34183 affecting package openssl for versions less than 3.3.7-3","description":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","status":"published","published":"2026-06-09T17:17:05Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0253","title":"Updated openssl packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nPossible Heap Buffer Overflow in ASN.1 Multibyte String Conversion.\n(CVE-2026-7383)\nOut-of-Bounds Read in CMS Password-Based Decryption. (CVE-2026-9076)\nHeap Buffer Over-read in ASN.1 Content Parsing. (CVE-2026-34180)\nPKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys.\n(CVE-2026-34181)\nCMS AuthEnvelopedData Processing May Accept Forged Messages.\n(CVE-2026-34182)\nUnbounded Memory Growth in the QUIC PATH_CHALLENGE Handler.\n(CVE-2026-34183)\nNULL Pointer Dereference in QUIC Server Initial Packet Handling.\n(CVE-2026-42764)\nPossible NULL Dereference in Password-Based CMS Decryption.\n(CVE-2026-42766)\nNULL Pointer Dereference in CRMF EncryptedValue Decryption.\n(CVE-2026-42767)\nMulti-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and\nPKCS7_decrypt(). (CVE-2026-42768)\nTrust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate.\n(CVE-2026-42769)\nFFC-DH Peer Validation Uses Attacker-Supplied q. (CVE-2026-42770)\nAES-OCB IV Ignored on EVP_Cipher() Path. (CVE-2026-45445)\nIncorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV\nmodes. (CVE-2026-45446)\nHeap Use-After-Free in the PKCS7_verify(). (CVE-2026-45447)\n","status":"published","published":"2026-07-15T17:33:12Z","modified":"2026-07-15T17:49:59.909323566Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11023-1","title":"libopenssl-3-devel-3.5.3-6.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-13T00:00:00Z","modified":"2026-06-14T14:00:07.553225075Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21005-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:26:17Z","modified":"2026-06-30T18:24:35.407904348Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22251-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:23:46Z","modified":"2026-06-30T18:24:26.161789581Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22315-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:23:46Z","modified":"2026-07-02T18:24:09.732592143Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2648-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-26T11:06:32Z","modified":"2026-06-27T08:45:05.198594059Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}