libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...

CVE-2026-77131 Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

CVE-2026-77131

CVE-2026-77131 affects the TYPO3 extension SYSSY – TYPO3 Monitoring & Security Checks (syssy). When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it, resulting in a cleartext transmission of sensitive data. Exploitation r...

CVE-2026-77131 Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

EUVD-2026-65344

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

PT-2026-89727

This update for openssl-3-livepatches fixes the following issues: - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713...

OpenSSL Toolkit 3.5.8

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.5 LTS release...

OpenSSL Security Advisory 20260825

OpenSSL Security Advisory 20260825 - ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function...

OpenSSL Toolkit 4.0.2

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 4.0 release...

OpenSSL Toolkit 3.0.22

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.0 LTS release...

OpenSSL Toolkit 3.4.7

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.4 release...

PT-2026-81232

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

PT-2026-81307

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description An issue exists in the Certificate Management Protocol CMP password-based MAC protection verification. The library uses the X509 ALGOR get0 function to read the protectionAlg algorithm...

PT-2026-81301

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 4.0 Description Receiving a DTLS record for a future epoch during a handshake causes the system to buffer significantly more memory than the record requires. This occurs because the software retains the entire re...

CVE-2026-63076: NULL Pointer Dereference

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

PT-2026-81305

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description The Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message but fails to remove them even if the message is rejected or the certificates are invali...

PT-2026-81306

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description When processing QUIC traffic, the QUIC stack may retain metadata for ACK-only packets for the entire duration of a connection if a peer repeatedly sends ack-eliciting packets without...

CVE-2026-54874: Asymmetric Resource Consumption (Amplification)

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

OpenSSL Toolkit 3.6.4

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.6 release...