CVE-2026-63072: Out-of-bounds Write

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

PT-2026-81296

Name of the Vulnerable Software and Affected Versions miniOrange SAML SSO versions prior to 11.0.2 SAML SP Single Sign On – Login with ADFS versions prior to 6.4 SAML SP Single Sign On – SAML SSO login with Google Apps versions prior to 6.4 Description An authentication bypass exists due to the m...

Linux Distros Unpatched Vulnerability : CVE-2026-14457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured...

Linux Distros Unpatched Vulnerability : CVE-2026-63073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact...

CMP Indefinite Cache Growth of ExtraCerts

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

QUIC Server May Trigger Double Free When Processing INITIAL Packet

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

Excessive Memory Use Buffering DTLS Records for a Future Epoch

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

Heap Buffer Overflow in CMS Key Unwrapping

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

CVE-2026-63076: NULL Pointer Dereference

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

OpenSSL -- Multiple vulnerabilities

The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 Moderate Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63076 Moderate RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate CVE-2026-14457 Low Excessive...

SUSE-SU-2026:23327-1 Security update for snphost

This update for snphost fixes the following issues: - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270541. - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrapkey bsc1270642. - CVE-2026-41681: openssl:...

OPENSUSE-SU-2026:21638-1 Security update for snphost

This update for snphost fixes the following issues: - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270541. - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrapkey bsc1270642. - CVE-2026-41681: openssl:...

ROOT-OS-DEBIAN-13-CVE-2026-14456 CVE-2026-14456 in openssl - Patched by Root

Root has patched CVE-2026-14456 in the openssl package for Root:Debian:13. Multiple fixed versions available...

RHSA-2026:58563 Red Hat Security Advisory: openssl security update

Bulletin has no description...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...