Red Hat Security Advisory

RHSA-2026:19066

openssl security update

Released 2026-05-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) openssl-devel-1:3.5.5-2.el10_2, openssl-perl-1:3.5.5-2.el10_2
Red Hat Enterprise Linux BaseOS (v. 10) openssl-1:3.5.5-2.el10_2, openssl-libs-1:3.5.5-2.el10_2

Fixes 2 records

TI-2026-24346 CVE-2026-31790 · GHSA-vgxx-5xj5-q97x

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

MEDIUM 41

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +3 CWE-754

TI-2026-02285 CVE-2026-2673 · GHSA-wj64-gh9j-xm82

OpenSSL TLS 1.3 server may choose unexpected key agreement group

LOW 35

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-13 Partial fix · 3.6.2, 3.5.6 CWE-757