{"id":"CVE-2026-43823","aliases":["EUVD-2026-48288","GHSA-8q93-f6xh-4f6f","RHSA-2026:45784","RHSA-2026:45785"],"status":"published","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","description":"When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00428,"percentile":0.37376,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-415"],"published":"2026-07-23T14:33:20Z","modified":"2026-10-26T02:31:00Z","affected":[{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.0.0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"swift-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.3.3-0.1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"swift-lang-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.3.3-0.1.1.hum1"}]}],"bundled":5}],"products":[{"vendor":"apple","product":"swift-crypto"}],"references":[{"url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-8q93-f6xh-4f6f","tags":["exploit","Vendor Advisory","advisory","article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45784","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43823","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45784.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43823","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45785","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67322","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67326","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67323","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45785.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510021","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67326","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-43823","description":"When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.","status":"published","published":"2026-07-23T14:33:20.924Z","modified":"2026-07-23T18:12:10.258Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-48288","description":"When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.","status":"published","published":"2026-07-23T14:33:20Z","modified":"2026-07-23T18:12:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:42.161106Z"}],"nvd":[{"id":"CVE-2026-43823","description":"When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.","status":"published","published":"2026-07-23T15:17:05.613Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-43823","description":"When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.","status":"published","published":"2026-07-23T15:17:05.613Z","modified":"2026-10-26T02:31:00.835594792Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"RHSA-2026:45784","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-28T10:13:35Z","modified":"2026-10-20T10:09:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:45785","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-28T10:13:36Z","modified":"2026-10-20T10:09:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"}]}}