openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without prope...

AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792414477)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792414477 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a cra...

RHEL 9 : openssl (RHSA-2026:84572)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84572 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

RHEL 9 : openssl (RHSA-2026:84573)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84573 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

openssl security update

3.5.8-2.0.1 - Replace upstream references Orabug: 34340177 1:3.5.8-2 - Fixed DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 Resolves: RHEL-264479 1:3.5.8-1 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves:...

openssl security update

3.5.8-2.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.8-2 - Fixes DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 Resolves: RHEL-264466 1:3.5.8-1 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242944 Resolves:...

TencentOS Server 4: openssl (TSSA-2026:1178)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1178 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

curl: OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples

Summary When curl uses its OpenSSL backend with CURLOPTSSLVERIFYSTATUS the --cert-status tool option, a correctly signed OCSP response can be accepted forever if its optional nextUpdate field is absent. curl passes -1 as OpenSSL's maximum permitted age for thisUpdate, explicitly disabling the onl...

Security update for openssl-3 (important)

openSUSE security update: security update for openssl-3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22102-1 Rating: important References: bsc1280587 bsc1280589 bsc1280590 bsc1280591 bsc1280592 bsc1280594 bsc1280595 bsc1280596 bsc1280597 bsc12805...

curl: OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT_SSL_CTX_FUNCTION trust store or verify callback rejected

Summary: On OpenSSL builds with Apple SecTrust USEAPPLESECTRUST, for example Homebrew's curl, libcurl runs the handshake with SSLVERIFYNONE, calls the application's CURLOPTSSLCTXFUNCTION before it, and, if OpenSSL's verification fails, asks Apple SecTrust and accepts the server when SecTrust trus...

CLSA-2026-1792066324 openssl: Fix of CVE-2026-84782

CVE-2026-84782: reset initoff before a DTLS retransmission and skip retransmitting while a handshake write is still suspended...

openssl: Fix of CVE-2026-84782

CVE-2026-84782: reset initoff before a DTLS retransmission and skip retransmitting while a handshake write is still suspended...

curl: CVE-2026-111952: OpenSSL provider use-after-free again

Summary Since 8.23.0, libcurl caches its OpenSSL certificate store per multi handle even when CURLOPTCAPATH is set. OpenSSL loads CApath certificates lazily during verification, and they belong to the library context of the transfer that loaded them. With CURLOPTSSLENGINE that is a private...

[SECURITY] Fedora 43 Update: openssl-3.5.9-1.fc43

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

OESA-2026-4324 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...

OESA-2026-4323 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...

OESA-2026-4322 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...