CVE-2026-42770

CVE-2026-42770 affects OpenSSL FIPS modules (4.0, 3.6, 3.5, 3.4, 3.0) and related deployments using EVP_PKEY_derive_set_peer() with DHX/X9.42 keys. The vulnerability arises when the subgroup check Y^q ≡ 1 (mod p) uses the peer’s q instead of the local key’s q, allowing a malicious X9.42 peer to c...

CVE-2026-42770 FFC-DH Peer Validation Uses Attacker-Supplied q

Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r a small prime factor of the cofacto...

CVE-2026-42766 Possible NULL Dereference in Password-Based CMS Decryption

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is define...

CVE-2026-42764 NULL Pointer Dereference in QUIC Server Initial Packet Handling

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial ...

CVE-2026-34183

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATHCHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QU...

CVE-2026-34181

The CVE-2026-34181 issue affects PKCS#12 file processing in OpenSSL where insufficient input validation for PBMAC1 allows forging certificates and private keys. An attacker impersonating a user could cause a service that reads PKCS#12 files to accept forged certificates and keys with about a 1 in...

GHSA-H749-FXX7-PWPG vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

GHSA-HV4R-MVR4-25VW vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

CVE-2026-41145 vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

CVE-2026-39414 vulnerabilities

Vulnerabilities for packages: minio-fips, minio...

GHSA-W573-9FFJ-6FF9 vulnerabilities

Vulnerabilities for packages: keycloak, management-api-for-apache-cassandra-5.0, camunda, strimzi-kafka-operator-fips, s3proxy, seata, apache-hop-fips, kayenta, apache-pulsar-fips, request-9047-keycloak-fips, zookeeper-fips, celeborn, pinot-fips, flyway, solr, tez, akhq, cassandra-reaper,...

CVE-2026-45536 vulnerabilities

Vulnerabilities for packages: keycloak, management-api-for-apache-cassandra-5.0, camunda, strimzi-kafka-operator-fips, s3proxy, seata, apache-hop-fips, kayenta, apache-pulsar-fips, request-9047-keycloak-fips, zookeeper-fips, celeborn, pinot-fips, flyway, solr, tez, akhq, cassandra-reaper,...

CVE-2026-45416 vulnerabilities

Vulnerabilities for packages: keycloak, sonarqube, ghidra, management-api-for-apache-cassandra-5.0, camunda, selenium, strimzi-kafka-operator-fips, s3proxy, seata, apache-hop-fips, commercial-elasticsearch, apache-pulsar-fips, kayenta, request-9047-keycloak-fips, zookeeper-fips, celeborn,...

GHSA-X4GW-5CX5-PGMH vulnerabilities

Vulnerabilities for packages: keycloak, sonarqube, ghidra, management-api-for-apache-cassandra-5.0, camunda, selenium, strimzi-kafka-operator-fips, s3proxy, seata, apache-hop-fips, commercial-elasticsearch, apache-pulsar-fips, kayenta, request-9047-keycloak-fips, zookeeper-fips, celeborn,...

CVE-2026-44249 vulnerabilities

Vulnerabilities for packages: keycloak, sonarqube, ghidra, management-api-for-apache-cassandra-5.0, camunda, selenium, strimzi-kafka-operator-fips, s3proxy, seata, apache-hop-fips, commercial-elasticsearch, apache-pulsar-fips, kayenta, request-9047-keycloak-fips, zookeeper-fips, celeborn,...

GHSA-3QP7-7MW8-WX86 vulnerabilities

Vulnerabilities for packages: keycloak, sonarqube, ghidra, management-api-for-apache-cassandra-5.0, camunda, selenium, strimzi-kafka-operator-fips, s3proxy, seata, apache-hop-fips, commercial-elasticsearch, apache-pulsar-fips, kayenta, request-9047-keycloak-fips, zookeeper-fips, celeborn,...

GHSA-QP9X-WP8F-QGJJ vulnerabilities

Vulnerabilities for packages: datadog-agent, datadog-agent-fips...

GHSA-6GHJ-FRRJ-JJJ3 vulnerabilities

Vulnerabilities for packages: tez, trino, thingsboard, management-api-for-apache-cassandra-5.0, pinot, seata, apache-hop-fips, apache-hop, management-api-for-apache-cassandra-4.1, celeborn, pinot-fips, management-api-for-apache-cassandra-4.0...

GHSA-3244-J874-RHC2 vulnerabilities

Vulnerabilities for packages: tez, trino, thingsboard, management-api-for-apache-cassandra-5.0, pinot, seata, apache-hop-fips, apache-hop, management-api-for-apache-cassandra-4.1, celeborn, pinot-fips, management-api-for-apache-cassandra-4.0...

CVE-2026-44890 vulnerabilities

Vulnerabilities for packages: tez, trino, thingsboard, management-api-for-apache-cassandra-5.0, pinot, seata, apache-hop-fips, apache-hop, management-api-for-apache-cassandra-4.1, celeborn, pinot-fips, management-api-for-apache-cassandra-4.0...