Vulnerability-Lookup

RHSA-2026:35869

Vulnerability from csaf_redhat - Published: 2026-07-06 08:58 - Updated: 2026-07-06 12:07

Summary

Red Hat Security Advisory: compat-openssl11 security update

Severity

Important

Notes

Topic: An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases. Security Fix(es): * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-28390

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 16 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-45447

A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 16 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

19 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:35869	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456314	external
https://bugzilla.redhat.com/show_bug.cgi?id=2481898	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-28390	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456314	external
https://www.cve.org/CVERecord?id=CVE-2026-28390	external
https://nvd.nist.gov/vuln/detail/CVE-2026-28390	external
https://github.com/openssl/openssl/commit/01194a8…	external
https://github.com/openssl/openssl/commit/2e39b7a…	external
https://github.com/openssl/openssl/commit/af2a5fe…	external
https://github.com/openssl/openssl/commit/ea7b4ea…	external
https://github.com/openssl/openssl/commit/fd2f1a6…	external
https://openssl-library.org/news/secadv/20260407.txt	external
https://access.redhat.com/security/cve/CVE-2026-45447	self
https://bugzilla.redhat.com/show_bug.cgi?id=2481898	external
https://www.cve.org/CVERecord?id=CVE-2026-45447	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45447	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:35869",
        "url": "https://access.redhat.com/errata/RHSA-2026:35869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2456314",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
      },
      {
        "category": "external",
        "summary": "2481898",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35869.json"
      }
    ],
    "title": "Red Hat Security Advisory: compat-openssl11 security update",
    "tracking": {
      "current_release_date": "2026-07-06T12:07:54+00:00",
      "generator": {
        "date": "2026-07-06T12:07:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.1"
        }
      },
      "id": "RHSA-2026:35869",
      "initial_release_date": "2026-07-06T08:58:27+00:00",
      "revision_history": [
        {
          "date": "2026-07-06T08:58:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-06T08:58:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-06T12:07:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                  "product_id": "AppStream-9.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
                "product": {
                  "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
                  "product_id": "compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11@1.1.1k-5.el9_6.3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
                "product": {
                  "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
                  "product_id": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debugsource@1.1.1k-5.el9_6.3?arch=ppc64le\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
                "product": {
                  "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
                  "product_id": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debuginfo@1.1.1k-5.el9_6.3?arch=ppc64le\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
                "product": {
                  "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
                  "product_id": "compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11@1.1.1k-5.el9_6.3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
                "product": {
                  "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
                  "product_id": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debugsource@1.1.1k-5.el9_6.3?arch=s390x\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
                "product": {
                  "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
                  "product_id": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debuginfo@1.1.1k-5.el9_6.3?arch=s390x\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
                "product": {
                  "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
                  "product_id": "compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11@1.1.1k-5.el9_6.3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64",
                "product": {
                  "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64",
                  "product_id": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debugsource@1.1.1k-5.el9_6.3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
                "product": {
                  "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
                  "product_id": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debuginfo@1.1.1k-5.el9_6.3?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
                "product": {
                  "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
                  "product_id": "compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11@1.1.1k-5.el9_6.3?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
                "product": {
                  "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
                  "product_id": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debugsource@1.1.1k-5.el9_6.3?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
                "product": {
                  "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
                  "product_id": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debuginfo@1.1.1k-5.el9_6.3?arch=i686\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.src",
                "product": {
                  "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.src",
                  "product_id": "compat-openssl11-1:1.1.1k-5.el9_6.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11@1.1.1k-5.el9_6.3?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
                "product": {
                  "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
                  "product_id": "compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11@1.1.1k-5.el9_6.3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
                "product": {
                  "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
                  "product_id": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debugsource@1.1.1k-5.el9_6.3?arch=aarch64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
                "product": {
                  "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
                  "product_id": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/compat-openssl11-debuginfo@1.1.1k-5.el9_6.3?arch=aarch64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64"
        },
        "product_reference": "compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686"
        },
        "product_reference": "compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le"
        },
        "product_reference": "compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x"
        },
        "product_reference": "compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src"
        },
        "product_reference": "compat-openssl11-1:1.1.1k-5.el9_6.3.src",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64"
        },
        "product_reference": "compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64"
        },
        "product_reference": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686"
        },
        "product_reference": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le"
        },
        "product_reference": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x"
        },
        "product_reference": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64"
        },
        "product_reference": "compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64"
        },
        "product_reference": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686"
        },
        "product_reference": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le"
        },
        "product_reference": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x"
        },
        "product_reference": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
        },
        "product_reference": "compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-28390",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-04-07T23:01:18.313921+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456314"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE has been rated as moderate by redhat because the vulnerability is limited to a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS processing, without evidence of memory corruption or code execution, furthermore the Affected functionality is niche. The vulnerable path requires:\nCMS/S/MIME processing,\nspecifically CMS_decrypt(),\nwith RSA-OAEP KeyTransportRecipientInfo.\nMany OpenSSL consumers never use CMS APIs, never process S/MIME,\nor do not decrypt attacker-controlled CMS objects.\nSo exposure is far narrower than a generic TLS parsing vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456314",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28390",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc",
          "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6",
          "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4",
          "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788",
          "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75",
          "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T22:00:54.172000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T08:58:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35869"
        },
        {
          "category": "workaround",
          "details": "Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing"
    },
    {
      "cve": "CVE-2026-45447",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481898"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This High severity heap use-after-free flaw in OpenSSL\u0027s PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
          "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481898",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T08:58:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35869"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.src",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debuginfo-1:1.1.1k-5.el9_6.3.x86_64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.aarch64",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.i686",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.ppc64le",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.s390x",
            "AppStream-9.6.0.Z.EUS:compat-openssl11-debugsource-1:1.1.1k-5.el9_6.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
    }
  ]
}

CVE-2026-28390 (GCVE-0-2026-28390)

Vulnerability from cvelistv5 – Published: 2026-04-07 22:00 – Updated: 2026-05-12 12:09

Title

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

Summary

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl

References

8 references

URL	Tags
https://openssl-library.org/news/secadv/20260407.txt	vendor-advisory
https://github.com/openssl/openssl/commit/01194a8…	patch
https://github.com/openssl/openssl/commit/2e39b7a…	patch
https://github.com/openssl/openssl/commit/ea7b4ea…	patch
https://github.com/openssl/openssl/commit/fd2f1a6…	patch
https://github.com/openssl/openssl/commit/af2a5fe…	patch
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 3.6.0 , < 3.6.2 (semver) Affected: 3.5.0 , < 3.5.6 (semver) Affected: 3.4.0 , < 3.4.5 (semver) Affected: 3.3.0 , < 3.3.7 (semver) Affected: 3.0.0 , < 3.0.20 (semver) Affected: 1.1.1 , < 1.1.1zg (custom) Affected: 1.0.2 , < 1.0.2zp (custom)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Date Public

2026-04-07 14:00

Credits

Muhammad Daffa Zhanpeng Liu (Tencent Xuanwu Lab) Guannan Wang (Tencent Xuanwu Lab) Guancheng Li (Tencent Xuanwu Lab) Joshua Rogers (Aisle Research) Chanho Kim Neil Horman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28390",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T20:24:15.925981Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T20:26:06.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:09:02.294Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.6.2",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.6",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.5",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.7",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.20",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zg",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zp",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Muhammad Daffa"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zhanpeng Liu (Tencent Xuanwu Lab)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Guannan Wang (Tencent Xuanwu Lab)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Guancheng Li (Tencent Xuanwu Lab)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Chanho Kim"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Neil Horman"
        }
      ],
      "datePublic": "2026-04-07T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: During processing of a crafted CMS EnvelopedData message\u003cbr\u003ewith KeyTransportRecipientInfo a NULL pointer dereference can happen.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that process attacker-controlled CMS data may\u003cbr\u003ecrash before authentication or cryptographic operations occur resulting in\u003cbr\u003eDenial of Service.\u003cbr\u003e\u003cbr\u003eWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\u003cbr\u003eRSA-OAEP encryption is processed, the optional parameters field of\u003cbr\u003eRSA-OAEP SourceFunc algorithm identifier is examined without checking\u003cbr\u003efor its presence. This results in a NULL pointer dereference if the field\u003cbr\u003eis missing.\u003cbr\u003e\u003cbr\u003eApplications and services that call CMS_decrypt() on untrusted input\u003cbr\u003e(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-15T07:28:22.729Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "name": "3.6.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
        },
        {
          "name": "3.5.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
        },
        {
          "name": "3.4.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
        },
        {
          "name": "3.3.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
        },
        {
          "name": "3.0.20 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-28390",
    "datePublished": "2026-04-07T22:00:54.172Z",
    "dateReserved": "2026-02-27T13:45:02.161Z",
    "dateUpdated": "2026-05-12T12:09:02.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45447 (GCVE-0-2026-45447)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-07-06 12:04

Title

Heap Use-After-Free in the PKCS7_verify() Function

Summary

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free
CWE-825 - Expired Pointer Dereference

Assigner

openssl

References

16 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/3aad5eb…	patch
https://github.com/openssl/openssl/commit/c505d75…	patch
https://github.com/openssl/openssl/commit/7d4a980…	patch
https://github.com/openssl/openssl/commit/a541ae8…	patch
https://github.com/openssl/openssl/commit/9dfd688…	patch
https://access.redhat.com/security/cve/CVE-2026-45447	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2481898	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:25237	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35869	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25239	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26275	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34102	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26319	vendor-advisoryx_refsource_REDHAT

Impacted products

19 products

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver) Affected: 3.4.0 , < 3.4.6 (semver) Affected: 3.0.0 , < 3.0.21 (semver) Affected: 1.1.1 , < 1.1.1zh (custom) Affected: 1.0.2 , < 1.0.2zq (custom)
Red Hat	Red Hat Enterprise Linux AppStream (v. 10)	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux AppStream EUS (v.9.6)	cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat	Red Hat Enterprise Linux AppStream (v. 9)	cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux BaseOS (v. 10)	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux BaseOS (v. 8)	cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)	cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux BaseOS E4S (v.8.8)	cpe:/o:redhat:rhel_e4s:8.8::baseos
Red Hat	Red Hat Enterprise Linux BaseOS TUS (v.8.8)	cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux BaseOS (v. 9)	cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Discovery 2	cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Insights proxy 1.5	cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10

Date Public

2026-06-09 14:00

Credits

Thai Duong (Calif.io in collaboration with Claude and Anthropic Research) Igor Ustinov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-45447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T03:59:38.212378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T13:32:20.413Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 10)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 9)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux BaseOS (v. 10)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8::baseos"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux BaseOS (v. 8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8::baseos"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux BaseOS E4S (v.8.8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8::baseos"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux BaseOS TUS (v.8.8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9::baseos"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux BaseOS (v. 9)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:insights_proxy:1.5::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Insights proxy 1.5",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-09T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T12:04:54.450Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
          },
          {
            "name": "RHBZ#2481898",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25237"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35869"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25239"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26275"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29197"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34102"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26319"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:25237: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35869: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25239: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26275: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29197: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34102: Red Hat Insights proxy 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26319: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-27T14:17:46.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-09T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.21",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zh",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zq",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Thai Duong (Calif.io in collaboration with Claude and Anthropic Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Igor Ustinov"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\u003cbr\u003etrigger a use-after-free during PKCS#7 signature verification.\u003cbr\u003e\u003cbr\u003eImpact summary: A use-after-free may result in process crashes, heap\u003cbr\u003ecorruption, or potentially remote code execution.\u003cbr\u003e\u003cbr\u003eWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\u003cbr\u003edigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\u003cbr\u003eincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\u003cbr\u003euse of the BIO by the calling application results in a use-after-free\u003cbr\u003econdition.\u003cbr\u003e\u003cbr\u003eIn the common case this occurs when the application later calls\u003cbr\u003eBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\u003cbr\u003eon allocator behavior and application-specific BIO usage patterns, this\u003cbr\u003emay result in a crash or other memory corruption. In some application\u003cbr\u003econtexts this may potentially be exploitable for remote code execution.\u003cbr\u003e\u003cbr\u003eApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\u003cbr\u003ePKCS#7 APIs may be affected. Applications using the CMS APIs for this\u003cbr\u003eprocessing are not affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "High"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:15.381Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
        },
        {
          "name": "3.0.21 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap Use-After-Free in the PKCS7_verify() Function",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-45447",
    "datePublished": "2026-06-09T16:03:32.914Z",
    "dateReserved": "2026-05-12T14:34:06.277Z",
    "dateUpdated": "2026-07-06T12:04:54.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:35869

CVE-2026-28390 (GCVE-0-2026-28390)

CVE-2026-45447 (GCVE-0-2026-45447)

Tags

Sightings

Nomenclature