{"id":"CVE-2026-42768","aliases":["ALPINE-CVE-2026-42768","ALSA-2026:25237","ALSA-2026:25239","AZL-90090","BELL-CVE-2026-42768","CLSA-2026-1785335008","CLSA-2026-1785335298","CLSA-2026-1785489462","DEBIAN-CVE-2026-42768","EUVD-2026-35485","GHSA-5m8f-m8jv-3rp3","JLSEC-2026-1140","MGASA-2026-0253","OESA-2026-3002","OESA-2026-3003","OESA-2026-3004","OESA-2026-3005","OESA-2026-3006","RHSA-2026:25237","RHSA-2026:25239","RHSA-2026:42825","RHSA-2026:55543","RHSA-2026:59635","RHSA-2026:59641","RHSA-2026:62562","RHSA-2026:62563","RHSA-2026:62790","RHSA-2026:67551","RLSA-2026:25237","RLSA-2026:25239","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","SUSE-SU-2026:2648-1","UBUNTU-CVE-2026-42768","openSUSE-SU-2026:11023-1","openSUSE-SU-2026:21005-1"],"status":"published","title":"Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00801,"percentile":0.57068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-514"],"published":"2026-06-09T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.7-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.6-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.6.3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"AppBundler","fixed_in":["1.0.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.5.7+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.3.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.7-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8_5.tuxcare.els20"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8_5.tuxcare.els20"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8_5.tuxcare.els20"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8_5.tuxcare.els20"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8_5.tuxcare.els20"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els10"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els10"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els10"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els10"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els10"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8_4.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8_4.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8_4.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8_4.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8_4.tuxcare.els21"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.6-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.3-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3","3.6.2-1"]},{"source":"osv","ecosystem":"Julia","package":"AppBundler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0+0"},{"fixed":"3.5.7+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.203+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1.mga10"}]}],"bundled":15},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-1.mga9"}]}],"bundled":15},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-45.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-45.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-38.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-36.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-41.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"chunkah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:50.0.0-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:50.0.0-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-fips-provider-upstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.8-0.1.hum1"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.10-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.20.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.3.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem3.3-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.9-23.6.hum1"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.3.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.4-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.5-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-37.3.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.7.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bootupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-bootupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-1.hum1"}]}],"bundled":19},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el10_2"}]}],"bundled":15},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-4.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.36.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.4"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3","3.5.3-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.2"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.8.1"}]}],"bundled":15}],"products":[{"vendor":"openssl","product":"openssl"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260609.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42768","tags":["web","advisory"]},{"url":"https://github.com/openssl/security/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f","tags":["web"]},{"url":"https://github.com/openssl/security/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d","tags":["web"]},{"url":"https://github.com/openssl/security/commit/dd68364107a58841c0a2546812518b65d3a23abd","tags":["web"]},{"url":"https://github.com/openssl/security/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5m8f-m8jv-3rp3","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42768","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25237","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34180","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34181","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34182","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34183","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42764","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42766","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42767","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42768","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42769","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42770","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45445","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45446","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45447","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9076","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481879","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481880","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481881","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481882","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481887","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481890","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481891","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481892","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481893","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481894","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481896","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2481898","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-25237.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25239","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-25239.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-42768","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1785335008.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1785335298.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1785489462.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42768.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42768","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35662","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/15","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8414-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00245.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6FSVWKLYXUHNRSEKJHJA6OVPW64N45U/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YTQ27HDP33LD6AS24REY2JEVD6LKVTQQ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42767","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3003","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3004","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3005","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42770","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25237.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7383","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9076","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34180","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34181","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34183","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42764","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42766","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42767","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42768","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42769","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42770","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45445","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45446","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25239.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42825","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54876","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75803","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42765","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42771","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35188","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42825.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35188","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42765","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42771","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511600","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54876","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260805.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260825.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93599","tags":["advisory"]},{"url":"https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69248","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69249","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69247","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84782","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55543.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69247","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/15369","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510830","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69248","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/14888","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69249","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/14960","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","tags":["advisory"]},{"url":"https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14457","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63076","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63075","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54874","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18798","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59635.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517562","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14457","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517561","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59641","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84783","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59641.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84783","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260929.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62562","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80213","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62562.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80212","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea","tags":["article"]},{"url":"https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80213","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/b336e42d6a3e2a824308f7b47fa26a968641b366","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62563","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62563.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62790","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62790.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67551.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25237","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25239","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622251-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259652","tags":["report"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266344","tags":["report"]},{"url":"https://bugzilla.suse.com/1266345","tags":["report"]},{"url":"https://bugzilla.suse.com/1266347","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266350","tags":["report"]},{"url":"https://bugzilla.suse.com/1266351","tags":["report"]},{"url":"https://bugzilla.suse.com/1266352","tags":["report"]},{"url":"https://bugzilla.suse.com/1266353","tags":["report"]},{"url":"https://bugzilla.suse.com/1266355","tags":["report"]},{"url":"https://bugzilla.suse.com/1266356","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622315-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262648-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266343","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34181","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42768","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42768","title":"Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T16:03:28.206Z","modified":"2026-06-10T07:48:04.77Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-35485","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T16:03:28Z","modified":"2026-06-10T07:48:04Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:45.803611Z"}],"ghsa":[{"id":"GHSA-5m8f-m8jv-3rp3","title":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style...","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T18:30:43Z","modified":"2026-06-10T09:32:58Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T15:08:43.417477Z"}],"nvd":[{"id":"CVE-2026-42768","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:08.223Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-514"],"updated_at":"2026-11-02T14:12:23.109705Z"}],"osv":[{"id":"ALPINE-CVE-2026-42768","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:08.223Z","modified":"2026-10-01T02:17:49.297589901Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-42768","status":"published","published":"2026-06-10T13:01:31.830892Z","modified":"2026-06-11T07:15:06.327555456Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-42768","title":"Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T16:03:28.206Z","modified":"2026-11-11T13:23:13.628465544Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-514"],"updated_at":"2026-11-11T11:06:45.459796Z"},{"id":"DEBIAN-CVE-2026-42768","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output.  Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key.  The attack is possible in 2 variants.  1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success.  An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available.  That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it.  2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted.  An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle.  We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity.  To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled.  The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key.  The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption.  The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:08.223Z","modified":"2026-10-01T03:03:22.971707307Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"JLSEC-2026-1140","title":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style...","description":"Issue summary: The `CMS_decrypt` and `PKCS7_decrypt` functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n 1. The decryption API (`CMS_decrypt()`, `PKCS7_decrypt()`) is used without\n    providing the recipient certificate. In this case OpenSSL iterates over every\n    KeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n 2. When the decryption API (`CMS_decrypt()`, `PKCS7_decrypt()`) is provided with\n    the recipient certificate, and the recipient is not found, a random\n    key is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked `EVP_PKEY_decrypt()` will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-08-03T19:08:57.739Z","modified":"2026-08-13T13:00:06.161969851Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-3002","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42766)\n\nIssue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42767)\n\nIssue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim\u0026apos;s vulnerable application as a way to decrypt or sign messages with the\nvictim\u0026apos;s private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim\u0026apos;s public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u0026apos;98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim\u0026apos;s key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.(CVE-2026-42768)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.162511501Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3003","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42766)\n\nIssue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42767)\n\nIssue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim\u0026apos;s vulnerable application as a way to decrypt or sign messages with the\nvictim\u0026apos;s private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim\u0026apos;s public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u0026apos;98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim\u0026apos;s key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.(CVE-2026-42768)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.174768603Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3004","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42766)\n\nIssue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim\u0026apos;s vulnerable application as a way to decrypt or sign messages with the\nvictim\u0026apos;s private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim\u0026apos;s public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u0026apos;98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim\u0026apos;s key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.(CVE-2026-42768)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.35606627Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3005","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42766)\n\nIssue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim\u0026apos;s vulnerable application as a way to decrypt or sign messages with the\nvictim\u0026apos;s private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim\u0026apos;s public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u0026apos;98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim\u0026apos;s key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.(CVE-2026-42768)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.327254949Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3006","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42766)\n\nIssue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-42767)\n\nIssue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim\u0026apos;s vulnerable application as a way to decrypt or sign messages with the\nvictim\u0026apos;s private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim\u0026apos;s public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u0026apos;98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim\u0026apos;s key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.(CVE-2026-42768)\n\nIssue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim\u0026apos;s p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p−1)/q_local), and a public value Y of order r can recover the\nvictim\u0026apos;s private key after a small number of key exchange attempts.\n\nWhen EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q ≡ 1 (mod p) is performed using the peer\u0026apos;s\nown q parameter, not the local key\u0026apos;s q. The peer\u0026apos;s domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim\u0026apos;s p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod r. Repeating for each small-prime\nfactor of the cofactor and combining via CRT recovers the full private\nkey (Lim–Lee / small-subgroup-confinement attack).\n\nThe realistic attack surface is narrow: principally CMP deployments with\nlong-lived RA/CA DHX keys and bespoke enterprise or government applications\nusing X9.42 DHX static keys with interactive protocols and therefore this\nissue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this\nissue.(CVE-2026-42770)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.375093778Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:25237","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-12T10:07:07Z","modified":"2026-10-20T10:06:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25239","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-12T10:07:08Z","modified":"2026-10-20T10:06:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:42825","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-29T10:05:47Z","modified":"2026-10-20T10:09:07Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:55543","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-29T10:06:17Z","modified":"2026-10-20T10:11:20Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59635","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:54Z","modified":"2026-10-20T10:12:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59641","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:54Z","modified":"2026-10-20T10:12:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62562","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-03T10:14:27Z","modified":"2026-10-20T10:12:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62563","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-03T10:14:28Z","modified":"2026-10-20T10:12:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62790","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:08Z","modified":"2026-10-20T10:12:46Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67551","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:18:42Z","modified":"2026-10-20T10:13:58Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:25237","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n\n* openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n\n* openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n\n* openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n\n* openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n\n* openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n\n* openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n\n* openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n\n* openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n\n* openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n\n* openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:05:06.020189Z","modified":"2026-06-13T00:30:05.753476822Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25239","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n\n* openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n\n* openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n\n* openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n\n* openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n\n* openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n\n* openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n\n* openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n\n* openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n\n* openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n\n* openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n\n* openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:03:17.085789Z","modified":"2026-06-13T00:30:05.7593994Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-42768","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key.  The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T00:00:00Z","modified":"2026-10-17T12:58:16.261448262Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALSA-2026:25237","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:30:19.406512767Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25239","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)\n  * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)\n  * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)\n  * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)\n  * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n  * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)\n  * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)\n  * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)\n  * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)\n  * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)\n  * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)\n  * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)\n  * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n  * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)\n  * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:32:34.006971149Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-90090","title":"CVE-2026-42768 affecting package openssl for versions less than 3.3.7-3","description":"Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-06-09T17:17:08Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1785335008","title":"openssl: Fix of 5 CVEs","description":"- CVE-2026-34180: fix heap buffer over-read in ASN.1 content parsing caused by truncating a long content length to int\n- CVE-2026-7383: fix heap buffer overflow in ASN1_mbstring_ncopy() caused by signed integer overflow when computing the output length\n- CVE-2026-42766: fix NULL pointer dereference when keyDerivationAlgorithm is absent in CMS PasswordRecipientInfo\n- CVE-2026-9076: fix out-of-bounds read in kek_unwrap_key() check-byte validation for KEK ciphers with a block size below 4 octets\n- CVE-2026-42768: enforce implicit rejection for CMS and PKCS#7 RSA PKCS#1 v1.5 decryption","status":"published","published":"2026-07-29T14:23:41Z","modified":"2026-10-26T09:43:28.796378207Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785335298","title":"openssl: Fix of 5 CVEs","description":"- CVE-2026-34180: fix heap buffer over-read in ASN.1 content parsing caused by truncating a long content length to int\n- CVE-2026-7383: fix heap buffer overflow in ASN1_mbstring_ncopy() caused by signed integer overflow when computing the output length\n- CVE-2026-42766: fix NULL pointer dereference when keyDerivationAlgorithm is absent in CMS PasswordRecipientInfo\n- CVE-2026-9076: fix out-of-bounds read in kek_unwrap_key() check-byte validation for KEK ciphers with a block size below 4 octets\n- CVE-2026-42768: enforce implicit rejection for CMS and PKCS#7 RSA PKCS#1 v1.5 decryption","status":"published","published":"2026-07-29T14:28:30Z","modified":"2026-10-26T09:43:35.680380044Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785489462","title":"openssl: Fix of 5 CVEs","description":"- CVE-2026-34180: fix heap buffer over-read in ASN.1 content parsing caused by truncating a long content length to int\n- CVE-2026-7383: fix heap buffer overflow in ASN1_mbstring_ncopy() caused by signed integer overflow when computing the output length\n- CVE-2026-42766: fix NULL pointer dereference when keyDerivationAlgorithm is absent in CMS PasswordRecipientInfo\n- CVE-2026-9076: fix out-of-bounds read in kek_unwrap_key() check-byte validation for KEK ciphers with a block size below 4 octets\n- CVE-2026-42768: enforce implicit rejection for CMS and PKCS#7 RSA PKCS#1 v1.5 decryption","status":"published","published":"2026-07-31T16:11:46Z","modified":"2026-10-26T09:43:22.899789101Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2026-0253","title":"Updated openssl packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nPossible Heap Buffer Overflow in ASN.1 Multibyte String Conversion.\n(CVE-2026-7383)\nOut-of-Bounds Read in CMS Password-Based Decryption. (CVE-2026-9076)\nHeap Buffer Over-read in ASN.1 Content Parsing. (CVE-2026-34180)\nPKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys.\n(CVE-2026-34181)\nCMS AuthEnvelopedData Processing May Accept Forged Messages.\n(CVE-2026-34182)\nUnbounded Memory Growth in the QUIC PATH_CHALLENGE Handler.\n(CVE-2026-34183)\nNULL Pointer Dereference in QUIC Server Initial Packet Handling.\n(CVE-2026-42764)\nPossible NULL Dereference in Password-Based CMS Decryption.\n(CVE-2026-42766)\nNULL Pointer Dereference in CRMF EncryptedValue Decryption.\n(CVE-2026-42767)\nMulti-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and\nPKCS7_decrypt(). (CVE-2026-42768)\nTrust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate.\n(CVE-2026-42769)\nFFC-DH Peer Validation Uses Attacker-Supplied q. (CVE-2026-42770)\nAES-OCB IV Ignored on EVP_Cipher() Path. (CVE-2026-45445)\nIncorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV\nmodes. (CVE-2026-45446)\nHeap Use-After-Free in the PKCS7_verify(). (CVE-2026-45447)\n","status":"published","published":"2026-07-15T17:33:12Z","modified":"2026-07-15T17:49:59.909323566Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11023-1","title":"libopenssl-3-devel-3.5.3-6.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-13T00:00:00Z","modified":"2026-06-14T14:00:07.553225075Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21005-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:26:17Z","modified":"2026-06-30T18:24:35.407904348Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22251-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:23:46Z","modified":"2026-06-30T18:24:26.161789581Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22315-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-22T12:23:46Z","modified":"2026-07-02T18:24:09.732592143Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2648-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343).\n- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).\n- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).\n- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-26T11:06:32Z","modified":"2026-06-27T08:45:05.198594059Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}