Read the docs
Red Hat Security Advisory

RHSA-2026:1473

openssl security update

Released 2026-01-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 12 records

TI-2025-14107 CVE-2025-15467 · GHSA-wvhq-3h88-rf6g

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Priority CRITICAL 85

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.74793 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +3 CWE-787
TI-2025-10249 CVE-2025-11187 · GHSA-hpc7-gcqm-58fv

Improper validation of PBMAC1 parameters in PKCS#12 MAC verification

Priority MEDIUM 62

Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification.

CVSS 3.1MEDIUM 6.1 Local Low privileges User interaction EPSS 0.05234 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +1 CWE-476
TI-2025-42864 CVE-2025-69421 · GHSA-w9rv-xc8m-cmqp

NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

Priority MEDIUM 41

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00944 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +5 CWE-476
TI-2025-42863 CVE-2025-69420 · GHSA-w42r-ph9f-9x66

Missing ASN1_TYPE validation in TS_RESP_verify_response() function

Priority MEDIUM 41

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereferen…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0092 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-754
TI-2025-42862 CVE-2025-69419 · GHSA-x77r-97gw-wh89

Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

Priority LOW 35

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the alloca…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00607 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-787
TI-2026-18314 CVE-2026-22796 · GHSA-r9hf-rxjm-gv2f

ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

Priority LOW 31

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer d…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00589 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +5 CWE-754
TI-2025-14108 CVE-2025-15468 · GHSA-rhx3-fg8p-f9m4

NULL dereference in SSL_CIPHER_find() function on unknown cipher ID

Priority LOW 28

Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00819 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +2 CWE-476
TI-2025-40703 CVE-2025-66199 · GHSA-5888-36j9-c92p

TLS 1.3 CompressedCertificate excessive memory allocation

Priority LOW 27

Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00463 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +2 CWE-789
TI-2026-18313 CVE-2026-22795 · GHSA-3vqq-45qg-2xf6

Missing ASN1_TYPE validation in PKCS#12 parsing

Priority LOW 24

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00179 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-754
TI-2025-14109 CVE-2025-15469 · GHSA-v2vr-926q-29fr

'openssl dgst' one-shot codepath silently truncates inputs >16MB

Priority LOW 24

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00213 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 CWE-347
TI-2025-41739 CVE-2025-68160 · GHSA-g78j-46j5-97cr

Heap out-of-bounds write in BIO_f_linebuffer on short writes

Priority LOW 21

Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00189 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +5 CWE-787
TI-2025-42861 CVE-2025-69418 · GHSA-78qr-24v5-7q73

Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

Priority LOW 18

Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and una…

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00132 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-325