PT-2026-61698

you don't need to overthink this 💡 an 11-byte TLS request can freeze server memory. that's the OpenSSL HollowByte vulnerability. here's what happened: a high-severity flaw CVE-2025-35588 discovered in OpenSSL versions 3.4.0, 3.3.0 to 3.3.3, 3.2.0… https://t.co/yXNb1p6oxS...

Medium: php8.5

Issue Overview: PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.5 Issue Correction: Run dnf update php8.5 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1957 --releasever 2023.12.20260720 to...

Medium: php

Issue Overview: PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php Note: This advisory is applicable to Amazon Linux 2 - Php8.2 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section...

TencentOS Server 3: openssl (TSSA-2026:0644)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0644 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-1958)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1958 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

TencentOS Server 3: compat-openssl10 (TSSA-2026:0619)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0619 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1957)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1957 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

OESA-2026-3048 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-3050 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-3049 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-3051 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-3004 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

OESA-2026-3005 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

OESA-2026-3003 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

MiracleLinux 9 : compat-openssl11-1.1.1k-5.el9_8.3 (AXSA:2026-1291:03)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1291:03 advisory. openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing CVE-2026-28390 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-45784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in...

SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2026:3094-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3094-1 advisory. This update for openssl-3 fixes the following issues - CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages...

SUSE SLED15 / SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:3102-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3102-1 advisory. This update for go1.26-openssl fixes the following issues - Update to version go1.26.5 bsc1255111. -...

CVE-2026-45784

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in openssl/src/cipherctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVPaes128,192,256wrappad. For a non-multiple-of-8...

AZL-92456 CVE-2026-45784 affecting package 389-ds-base 3.1.1-12

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in openssl/src/cipherctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVPaes128,192,256wrappad. For a non-multiple-of-8...