OESA-2026-4639 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64...

OESA-2026-4638 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64...

[SECURITY] [DLA 4859-1] openssl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4859-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout October 26, 2026 https://wiki.debian.org/LTS -...

Debian dla-4859 : libcrypto3-udeb - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4859 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4859-1 [email protected]...

Important: edk2

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in OpenSSL

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782 in OpenSSL as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-35189 DESCRIPTION: Issue summary: A certificate...

OESA-2026-4418 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL...

OESA-2026-4417 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL...

OESA-2026-4416 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL...

CLEANSTART-2026-XR25689 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel

CVE-2026-77696 affects multiple packages. Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. See references for individual vulnerability details...

CLEANSTART-2026-YQ62547 Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms

CVE-2026-54875 affects multiple packages. Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. See references for individual vulnerability details...

CLEANSTART-2026-KH74871 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secre...

CVE-2026-54872 affects multiple packages. Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. See references for individual...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpiecinit When the mpiecctx structure is initialized, certain fields are not cleared, leading to a crash when accessing these fields after the structure has been freed. Initially...

Important: openssl

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Important: openssl-snapsafe

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

SUSE CVE-2026-54872

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...

SUSE CVE-2026-54875

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

SUSE CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

CentOS Linux 7 [TuxCare] Security Update: openssl11 / openssl11-devel / openssl11-libs / openssl11-static Multiple Vulnerabilities (CENTOS7:CLSA-2026:1780683040)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1780683040 advisory. - In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application wi...