Red Hat Security Advisory

RHSA-2026:22312

openssl security update

Released 2026-06-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.5.5-3.el9_8, openssl-perl-1:3.5.5-3.el9_8
Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.5.5-3.el9_8, openssl-libs-1:3.5.5-3.el9_8

Fixes 2 records

TI-2026-22665 CVE-2026-28390 · GHSA-fgpp-q3px-3xhc

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

MEDIUM 40

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00836 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +5 CWE-476

TI-2026-02285 CVE-2026-2673 · GHSA-wj64-gh9j-xm82

OpenSSL TLS 1.3 server may choose unexpected key agreement group

LOW 35

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-13 Partial fix · 3.6.2, 3.5.6 CWE-757