27916 matches found
Oracle Linux 10 : openssl (ELSA-2026-76918)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-76918 advisory. 3.5.8-2.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.8-2 - Fixes DTLS Retransmits Handshake Messages...
RHEL 9 : openssl (RHSA-2026:77396)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77396 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...
EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3894)
According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...
openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()
A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...
openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
A flaw was found in OpenSSL. This vulnerability allows a remote attacker to forge PKCS12 Public-Key Cryptography Standards 12 files that use Password-Based Message Authentication Code 1 PBMAC1 with short HMAC Hash-based Message Authentication Code keys. This can lead to a service accepting...
Security update for openssl-3-livepatches
This update for openssl-3-livepatches fixes the following issue: CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset bsc1280587. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:4560-1 Security update for openssl-3-livepatches
This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset bsc1280587...
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System
Summary Multiple vulnerabilities were found in openSSL used by IBM OS Image for Red Hat Enterprise Linux Systems shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-34181 DESCRIPTION: Issue Summary: The...
CLSA-2026-1791199071 openssl: Fix of 2 CVEs
CVE-2026-84782: reset s-initoff to 0 in dtls1retransmitmessage so a DTLS retransmission is read from the start of the queued message instead of the offset left by a write suspended on WANTWRITE, and skip retransmission in dtls1handletimeout while such a write is still parked - CVE-2026-35189:...
ALSA-2026:77396 Important: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 For...
Important: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 For...
GHSA-W5F4-FX9M-M4Q7 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Summary Improper TLS hostname verification allows a man-in-the-middle MITM attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected the Schannel backend is not affected. Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity b...
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Summary Improper TLS hostname verification allows a man-in-the-middle MITM attack on MsQuic. Details Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected the Schannel backend is not affected. Patches 2.6.1, 2.5.11, and 2.4.20 Impact An on-path attacker could spoof a server identity b...
CVE-2026-105794
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
EUVD-2026-93422
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-pat...
CVE-2026-105794
MsQuic , a cross-platform C implementation of the IETF QUIC protocol, contains an improper certificate validation vulnerability (CWE-295) in versions prior to 2.4.20, 2.5.11, and 2.6.1 . When using the OpenSSL or QuicTLS TLS backends, the software fails to verify that a server certificate matches...