144 matches found
Low: ecs-service-connect-agent
Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...
Low: ecs-service-connect-agent
Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...
Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2026-3355)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3355 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a crafted...
CLEANSTART-2026-RV52446 Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X
CVE-2026-35189 affects multiple packages. Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X. See references for individual vulnerability details...
Amazon Linux 2 : openssl11 (ALAS-2026-3991)
The version of openssl11 installed on the remote host is prior to 1.1.1zj-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3991 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap...
CLSA-2026-1791229632 Fix CVE(s): CVE-2026-35189, CVE-2026-84782
SECURITY UPDATE: excessive memory use with relative CRL distribution point names - debian/patches/CVE-2026-35189.patch: build the full name of a nameRelativeToCRLIssuer distribution point only while matching a CRL instead of for every parsed certificate in crypto/x509v3/v3crld.c,...
CLSA-2026-1791200195 openssl: Fix of 2 CVEs
CVE-2026-84782: reset s-initoff to 0 in dtls1retransmitmessage so a DTLS retransmission is read from the start of the queued message instead of the offset left by a write suspended on WANTWRITE, and skip retransmission in dtls1handletimeout while such a write is still parked - CVE-2026-35189:...
CLSA-2026-1791193238 openssl11: Fix of 2 CVEs
CVE-2026-84782: reset initoff before a DTLS retransmission and skip it while a handshake write is suspended, avoiding a heap over-read - CVE-2026-35189: build relative CRL distribution point names only during CRL matching, avoiding unbounded heap growth when caching extensions...
CLSA-2026-1791192990 openssl11: Fix of 2 CVEs
CVE-2026-84782: reset initoff before a DTLS retransmission and skip it while a handshake write is suspended, avoiding a heap over-read - CVE-2026-35189: build relative CRL distribution point names only during CRL matching, avoiding unbounded heap growth when caching extensions...
CVE-2026-105301
Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only...
CVE-2026-105301
A flaw exists in the X.509 client-certificate authenticator of Keycloak , an identity and access management solution. When the server is configured to perform certificate revocation checks via CRL Distribution Points or OCSP , an attacker can provide a specially crafted certificate pointing to a ...
CVE-2026-105301
...
EUVD-2026-92255
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
CVE-2026-105301
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
CVE-2026-105301
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
PT-2026-104725
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
CVE-2026-105301: Server-Side Request Forgery (SSRF)
Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only...
SUSE CVE-2026-35189
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
CLSA-2026-1790933563 openssl: Fix of 2 CVEs
CVE-2026-84782: reset s-initoff to 0 in dtls1retransmitmessage and skip retransmission in dtls1handletimeout while a handshake write is still parked mid-flight, so a DTLS retransmit is no longer sent from the stale offset left behind by an unrelated suspended write - CVE-2026-35189: defer...