SUSE-SU-2026:4036-1 Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues: - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713. Patch Instruction...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issue: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

SUSE-SU-2026:4034-1 Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issue: - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788...

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: August 2026 release. CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch bsc1274795. CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1274788. Patch Instructions: To install this SUSE update use the SUS...

SUSE-SU-2026:4033-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: August 2026 release. - CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch bsc1274795. - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1274788...

Security update for openssl-3

This update for openssl-3 fixes the following issues: August 2026 release. CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch bsc1274795. CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1274788. CVE-2026-63074: CMP indefinite cache growth of ExtraCerts...

SUSE-SU-2026:4032-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: August 2026 release. - CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch bsc1274795. - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1274788. - CVE-2026-63074: CMP indefinite cache growth of...

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274300. CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion...

PT-2026-89673

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.0.2 through 6.0.7 Description The openssl plugin allows PKCS7 certificate enumeration, which results in a memory leak where memory is not released after its effective lifetime. Recommendations At the moment, there is no...

PT-2026-89672

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.0.2 through 6.0.7 Description An expired pointer dereference occurs during PKCS7 parsing within the openssl plugin. PKCS7 is a standard for cryptographic messages that allows for the signing and encryption of data...

AZL-99837 CVE-2026-80229 affecting package rust 1.75.0-31

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

AZL-99867 CVE-2026-80229 affecting package rust 1.90.0-10

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

ALPINE-CVE-2026-80229

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

AZL-99795 CVE-2026-80229 affecting package mysql 8.0.46-1

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

CVE-2026-80229

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-80229

The curl library is vulnerable to a heap-use-after-free flaw when using the multi interface with OpenSSL 3 provider configurations. The root cause is that libcurl attaches an allocated library context to an easy handle's state but fails to acquire an ownership reference. Consequently, destroying ...

CVE-2026-80229 OpenSSL provider use-after-free

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...