Red Hat Security Advisory

RHSA-2026:85968

openssl security update

Released 2026-10-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-18.el8_6, openssl-devel-1:1.1.1k-18.el8_6, openssl-libs-1:1.1.1k-18.el8_6 +1
Red Hat Enterprise Linux BaseOS E4S (v.8.8) openssl-1:1.1.1k-18.el8_6, openssl-devel-1:1.1.1k-18.el8_6, openssl-libs-1:1.1.1k-18.el8_6 +1
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) openssl-1:1.1.1k-18.el8_6, openssl-devel-1:1.1.1k-18.el8_6, openssl-libs-1:1.1.1k-18.el8_6 +1
Red Hat Enterprise Linux BaseOS TUS (v.8.8) openssl-1:1.1.1k-18.el8_6, openssl-devel-1:1.1.1k-18.el8_6, openssl-libs-1:1.1.1k-18.el8_6 +1

Fixes 2 records

TI-2026-58283 CVE-2026-84782 · GHSA-6w84-hw79-7wgf

DTLS Retransmits Handshake Messages From a Stale Buffer Offset

MEDIUM 43

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00831 Published 2026-09-29 Partial fix · 4.0.3, 3.6.5 +5 CWE-125

TI-2026-45026 CVE-2026-63072 · GHSA-wp5f-6q39-q2f4

Heap Buffer Overflow in CMS Key Unwrapping

MEDIUM 41

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing a…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00916 Published 2026-08-25 Partial fix · 4.0.2, 3.6.4 +4 CWE-787