OpenSSL Release Announcement and Security Advisory - 7th Apr 2026
OpenSSL Announce <[email protected]> Tue, 07 Apr 2026 20:39:42 +0000
| Newsgroups | gmane.comp.encryption.openssl.announce |
|---|---|
| Message-ID | <[email protected]> |
----_NmP-7b44d843556b7f4d-Part_1
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
OpenSSL Release Announcement and Security Advisory - 7th Apr 2026=20
https://api.ourmailsender4.com/open/image.png?key=3Dfd6bffb5b1037b700f887b5=
6ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0ea56c68f816121382113ee10b30_3=
8c0cec0dd6226962963c8d1c03af6e3
https://cdn1.ourmailsender4.=
com/userContent/38291/fileManager/42391/OpenSSL_DarkRed_Library.png
OpenSSL Release Announcement and Security Advisory - 7th Apr 2026
-----------------------------------------------------------------
Release Announcement for OpenSSL Library 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20=
, 1.1.1zg and 1.0.2zp
The OpenSSL Project team announces the release of new=
versions of our open-source toolkit for SSL/TLS.
Changes and CVEs fixed in=
3.6.2:
---CVE-2026-31790 : #CVE-2026-31790
=E2=80=94 Incorrect Failure =
Handling in RSA KEM RSASVE Encapsulation
---CVE-2026-28386: #CVE-2026-28386
=E2=80=94 Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support
---CVE-2026-28387: #CVE-2026-28387
=E2=80=94 Potential Use-after-free in =
DANE Client Code
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
---CVE-2026-28390: =
#CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
---CVE-2026-31789 : #CVE-2026-31789
=E2=80=94 Heap Buffer Overflow in Hexadecimal Conversion
Changes and CVEs fixed in 3.5.6:
---CVE-2026-31790 : #CVE-2026-31790
=E2=80=94 Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
---CVE-2026-28387: #CVE-2026-28387
=E2=80=94 Potential Use-after-free in =
DANE Client Code
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
---CVE-2026-28390: =
#CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
---CVE-2026-31789 : #CVE-2026-31789
=E2=80=94 Heap Buffer Overflow in Hexadecimal Conversion
CVEs fixed in 3.4.5:
---CVE-2026-31790 : #CVE-2026-31790
=E2=80=94 Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
---CVE-2026-28387: #CVE-2026-28387
=E2=80=94 Potential Use-after-free in =
DANE Client Code
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
---CVE-2026-28390: =
#CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
---CVE-2026-31789 : #CVE-2026-31789
=E2=80=94 Heap Buffer Overflow in Hexadecimal Conversion
CVEs fixed in 3.3.7:
---CVE-2026-31790 : #CVE-2026-31790
=E2=80=94 Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
---CVE-2026-28387: #CVE-2026-28387
=E2=80=94 Potential Use-after-free in =
DANE Client Code
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
---CVE-2026-28390: =
#CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
---CVE-2026-31789 : #CVE-2026-31789
=E2=80=94 Heap Buffer Overflow in Hexadecimal Conversion
CVEs fixed in 3.0.20:
---CVE-2026-31790 : #CVE-2026-31790
=E2=80=94 Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
---CVE-2026-28387: #CVE-2026-28387
=E2=80=94 Potential Use-after-free in =
DANE Client Code
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
---CVE-2026-28390: =
#CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
---CVE-2026-31789 : #CVE-2026-31789
=E2=80=94 Heap Buffer Overflow in Hexadecimal Conversion
CVEs fixed in 1.1.1zg: (premium support customers only)
---CVE-2026-28387: #CVE-2026-28387
=E2=80=94 Potential Use-after-free in =
DANE Client Code
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
---CVE-2026-28390: =
#CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
CVEs fixed in 1.0.2zp: (premium support customers=
only)
---CVE-2026-28388: #CVE-2026-28388
=E2=80=94 NULL Pointer =
Dereference When Processing a Delta CRL
---CVE-2026-28389 : #CVE-2026-28389
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyAgreeRecipientInfo
---CVE-2026-28390: #CVE-2026-28390
=E2=80=94 Possible NULL Dereference When Processing CMS =
KeyTransportRecipientInfo
All releases contain miscellaneous minor bug =
fixes. For details of the changes, refer to the release notes for versions =
1.0.2, 1.1.1, 3.0, 3.3, 3.4, 3.5 and 3.6.
Specific notes on upgrading from =
previous versions are available in the OpenSSL Migration Guide: =
https://docs.openssl.org/master/man7/ossl-guide-migration/
.
OpenSSL Library 3.x is available for download at these URLs:
---https://www.openssl.org/source/: https://www.openssl.org/source/
---https://github.com/openssl/openssl/releases: https://github.=
com/openssl/openssl/releases
The distribution file names are for:
---OpenSSL Library 3.6.2 - openssl-3.6.2: https://github.=
com/openssl/openssl/releases/tag/openssl-3.6.1
---OpenSSL Library 3.5.6 - =
openssl-3.5.6: https://github.com/openssl/openssl/releases/tag/openssl-3.5.=
5
---OpenSSL Library 3.4.5 - openssl-3.4.5: https://github.=
com/openssl/openssl/releases/tag/openssl-3.4.4
---OpenSSL Library 3.3.7 - =
openssl-3.3.7: https://github.com/openssl/openssl/releases/tag/openssl-3.3.=
6
---OpenSSL Library 3.0.20 - openssl-3.0.20: https://github.=
com/openssl/openssl/releases/tag/openssl-3.0.19
---OpenSSL Library 1.1.1zg =
- openssl-1.1.1zg: https://support.openssl.org/hc/en-us/articles/3287450153=
7682-Extended-Release-1-1-1ze
---OpenSSL Library 1.0.2zp - openssl-1.0.2zp:=
https://support.openssl.org/hc/en-us/articles/32874498766738-Extended-Rele=
ase-1-0-2zn
Security Advisory - 7th April 2026
---------------------------=
-----------
<a name=3D"CVE-2026-31790" id=3D"CVE-2026-31790" =
href=3D"#CVE-2026-31790" style=3D"color: #000000;"></a>CVE-2026-31790 - =
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
Link for this security advisory: CVE-2026-31790: https://www.openssl.=
org/news/vulnerabilities.html#CVE-2025-11187
Severity: Moderate
Issue summary: Applications using RSASVE key encapsulation to establish a =
secret encryption key can send contents of an uninitialized memory buffer =
to a malicious peer.
Impact summary: The uninitialized buffer might contain=
sensitive data from the previous execution of the application process =
which leads to sensitive data leakage to an attacker.
RSA_public_encrypt() returns the number of bytes written on success and -1 =
on error. The affected code tests only whether the return value is non-zero=
. As a result, if RSA encryption fails, encapsulation can still return =
success to the caller, set the output lengths, and leave the caller to use =
the contents of the ciphertext buffer as if a valid KEM ciphertext had been=
produced.
If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an=
attacker-supplied invalid RSA public key without first validating that key=
, then this may cause stale or uninitialized contents of the =
caller-provided ciphertext buffer to be disclosed to the attacker in place =
of the KEM ciphertext.
As a workaround calling EVP_PKEY_public_check() or =
EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate =
the issue.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected=
by this issue.
OpenSSL 1.0.2 and 1.1.1 are not affected by this issue.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 are vulnerable to this issue.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.7.
OpenSSL 3.4 users should=
upgrade to OpenSSL 3.4.5.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.=
6.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2.
This issue was reported by Simo Sorce (Red Hat) on 23rd Feburary 2026.
The fix was developed by Nikola Pajkovsky.
<a name=3D"CVE-2026-28386" =
id=3D"CVE-2026-28386" href=3D"#CVE-2026-28386" style=3D"color: =
#000000;"></a>CVE-2026-28386 - Out-of-bounds Read in AES-CFB-128 on X86-64 =
with AVX-512 Support
Link for this security advisory: CVE-2026-28386: =
https://www.openssl.org/news/vulnerabilities.html#CVE-2025-11187
Severity: Low
Issue summary: Applications using AES-CFB128 encryption or =
decryption on systems with AVX-512 and VAES support can trigger an =
out-of-bounds read of up to 15 bytes when processing partial cipher blocks.
Impact summary: This out-of-bounds read may trigger a crash which leads to =
Denial of Service for an application if the input buffer ends at a memory =
page boundary and the following page is unmapped. There is no information =
disclosure as the over-read bytes are not written to output.
The vulnerable code path is only reached when processing partial blocks =
(when a previous call left an incomplete block and the current call =
provides fewer bytes than needed to complete it). Additionally, the input =
buffer must be positioned at a page boundary with the following page =
unmapped. CFB mode is not used in TLS/DTLS protocols, which use CBC, GCM, =
CCM, or ChaCha20-Poly1305 instead. For these reasons the issue was assessed=
as
Low severity according to our Security Policy.
Only x86-64 systems with=
AVX-512 and VAES instruction support are affected. Other architectures and=
systems without VAES support use different code paths that are not =
affected.
OpenSSL FIPS module in 3.6 version is affected by this issue.
OpenSSL 3.0, 3.3, 3.4, 3.5, 1.1.1 and 1.0.2 are not vulnerable to this =
issue.
OpenSSL 3.6 is vulnerable to this issue.
OpenSSL 3.6 users should =
upgrade to OpenSSL 3.6.2.
This issue was reported on 6th January 2026 by =
Stanislav Fort and Pavel Kohout
(Aisle Research).
The fix was developed by =
Stanislav Fort and Pavel Kohout (Aisle Research).
It was independently =
reported on 10th March 2026 by Alex Gaynor (Anthropic).
<a name=3D"CVE-2026-28387" id=3D"CVE-2026-28387" href=3D"#CVE-2026-28387" =
style=3D"color: #000000;"></a>CVE-2026-28387 - Potential Use-after-free in =
DANE Client Code
Link for this security advisory: CVE-2026-28387: =
https://www.openssl.org/news/vulnerabilities.html#CVE-2025-11187
Severity: Low
Issue summary: An uncommon configuration of clients =
performing DANE TLSA-based server authentication, when paired with uncommon=
server DANE TLSA records, may result in a use-after-free and/or =
double-free on the client side.
Impact summary: A use after free can have a=
range of potential consequences such as the corruption of valid data, =
crashes or execution of arbitrary code.
However, the issue only affects =
clients that make use of TLSA records with both the PKIX TA(0/PKIX-EE(1) =
certificate usages and the DANE-TA(2) certificate usage.
By far the most common deployment of DANE is in SMTP MTAs for which RFC7672=
recommends that clients treat as "unusable" any TLSA records that have the=
PKIX certificate usages. These SMTP (or other similar) clients are not =
vulnerable to this issue. Conversely, any clients that support only the =
PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.
The client would also need to be communicating with a server that publishes=
a TLSA RRset with both types of TLSA records.
No FIPS modules are affected=
by this issue, the problem code is outside the
FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.
OpenSSL 3.6 users should =
upgrade to OpenSSL 3.6.2.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6=
.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.5.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.7.
OpenSSL 3.0 users should=
upgrade to OpenSSL 3.0.20.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1=
.1.1zg (premium
support customers only).
This issue was reported on the 8th=
of January 2026 by Igor Morgenstern (Aisle Research). The fix was =
developed by Viktor Dukhovni and Alexandr Nedvedicky.
<a name=3D"CVE-2026-28388" id=3D"CVE-2026-28388" href=3D"#CVE-2026-28388" =
style=3D"color: #000000;"></a>CVE-2026-28388 - NULL Pointer Dereference =
When Processing a Delta CRL
Link for this security advisory: =
CVE-2026-28388: https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-11187
Severity: Low
Issue summary: When a delta CRL that =
contains a Delta CRL Indicator extension is processed a NULL pointer =
dereference might happen if the required CRL Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which leads =
to a Denial of Service for an application.
When CRL processing and delta =
CRL processing is enabled during X.509 certificate verification, the delta =
CRL processing does not check whether the CRL Number extension is NULL =
before dereferencing it. When a malformed delta CRL file is being processed=
, this parameter can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be =
enabled in the verification context, the certificate being verified to =
contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST=
flag set, and an attacker to provide a malformed CRL to an application =
that processes it.
The vulnerability is limited to Denial of Service and =
cannot be escalated to achieve code execution or memory disclosure. For =
that reason the issue was assessed as Low severity according to our =
Security Policy.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not =
affected by this issue,
as the affected code is outside the OpenSSL FIPS =
module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are =
vulnerable to this issue.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2=
.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.5.
OpenSSL 3.3 users should=
upgrade to OpenSSL 3.3.7.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.=
20.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zg
(premium support customers only).
OpenSSL 1.0.2 users should upgrade to =
OpenSSL 1.0.2zp
(premium support customers only).
This issue was reported =
on 8th January 2026 by Igor Morgenstern (Aisle Research).=20
The fix was developed by Igor Morgenstern (Aisle Research).
<a name=3D"CVE-2026-28389" id=3D"CVE-2026-28389" href=3D"#CVE-2026-28389" =
style=3D"color: #000000;"></a>CVE-2026-28389 - Possible NULL Dereference =
When Processing CMS KeyAgreeRecipientInfo
Link for this security advisory:=
CVE-2026-28389: https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-11187
Severity: Low
Issue summary: During processing of a =
crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer=
dereference can happen.
Impact summary: Applications that process =
attacker-controlled CMS data may crash before authentication or =
cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is =
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifie=
r is examined without checking for its presence. This results in a NULL =
pointer dereference if the field is missing.
Applications and services that=
call CMS_decrypt() on untrusted input (e.g., S/MIME processing or =
CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3=
and 3.0 are not affected by this
issue, as the affected code is outside =
the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 =
and 1.0.2 are vulnerable to this issue.
OpenSSL 3.6 users should upgrade to=
OpenSSL 3.6.2.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.5.
OpenSSL 3.3 users should=
upgrade to OpenSSL 3.3.7.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.=
20.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zg.
(premium support customers only).
OpenSSL 1.0.2 users should upgrade to =
OpenSSL 1.0.2zp.
(premium support customers only).
This issue was reported =
on 13th February 2026 by Nathan Sportsman (Praetorian), on 25th February =
2026 by Daniel Rhea, on 15th March 2026 by Jaeho Nam (Seoul National =
University), on 26th March 2026 by Muhammad Daffa, on 27th March 2026 by =
Zhanpeng Liu (Tencent Xuanwu Lab), Guannan Wang (Tencent Xuanwu Lab) and =
Guancheng Li (Tencent Xuanwu Lab) and on 30th March 2026 by Joshua Rogers.
The fix was developed by Neil Horman.
<a name=3D"CVE-2026-28390" =
id=3D"CVE-2026-28390" href=3D"#CVE-2026-28390" style=3D"color: =
#000000;"></a>CVE-2026-28390 - Possible NULL Dereference When Processing =
CMS KeyTransportRecipientInfo
Link for this security advisory: =
CVE-2026-28390: https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-11187
Severity: Low
Issue summary: During processing of a =
crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL =
pointer dereference can happen.
Impact summary: Applications that process =
attacker-controlled CMS data may crash before authentication or =
cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with =
RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP=
SourceFunc algorithm identifier is examined without checking for its =
presence. This results in a NULL pointer dereference if the field is =
missing.
Applications and services that call CMS_decrypt() on untrusted =
input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this =
issue, as the affected code is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this =
issue.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.
OpenSSL 3.4 users should=
upgrade to OpenSSL 3.4.5.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.=
7.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zg.
(premium support customers only).
OpenSSL 1.0.2 users should upgrade to =
OpenSSL 1.0.2zp.
(premium support customers only).
This issue was reported =
on 26th March 2026 by Muhammad Daffa, on 27th March 2026 by Zhanpeng Liu =
(Tencent Xuanwu Lab), Guannan Wang (Tencent Xuanwu Lab) and Guancheng Li =
(Tencent Xuanwu Lab), on 30th March 2026 by Joshua Rogers and on 31st March=
2026 by Chanho Kim.=20
The fix was developed by Neil Horman.
<a name=3D"CVE-2026-31789" id=3D"CVE-2026-31789" href=3D"#CVE-2026-31789" =
style=3D"color: #000000;"></a>CVE-2026-31789 - Heap Buffer Overflow in =
Hexadecimal Conversion
Link for this security advisory: CVE-2026-31789: =
https://www.openssl.org/news/vulnerabilities.html#CVE-2025-11187
Severity: Low
Issue summary: Converting an excessively large OCTET STRING =
value to a hexadecimal string leads to a heap buffer overflow on 32 bit =
platforms.
Impact summary: A heap buffer overflow may lead to a crash or =
possibly an attacker controlled code execution or other undefined behavior.
If an attacker can supply a crafted X.509 certificate with an excessively =
large OCTET STRING value in extensions such as the Subject Key Identifier =
(SKID) or Authority Key Identifier (AKID) which are being converted to hex,=
the size of the buffer needed for the result is calculated as =
multiplication of the input length by 3. On 32 bit platforms, this =
multiplication may overflow resulting in the allocation of a smaller buffer=
and a heap buffer overflow.
Applications and services that print or log =
contents of untrusted X.509 certificates are vulnerable to this issue. As =
the certificates would have to have sizes of over 1 Gigabyte, printing or =
logging such certificates is a fairly unlikely operation and only 32 bit =
platforms are affected, this issue was assigned Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.
OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2.
OpenSSL 3.5 users should=
upgrade to OpenSSL 3.5.6.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.=
5.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.7.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.
This issue was reported on 16th February 2026 by Quoc Tran (Xint.io: =
https://api.ourmailsender4.com/c/80d95aed8af32d5bb3fd7029b07c33f2_2a4f8cf49=
e7ccab41204db7d3ad7d296?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d4=
0745acd5d07409f7851d&aid=3DXp2h
- US Team).
The fix was developed by Igor =
Ustinov.
General Advisory Notes
URL for this Security Advisory:
https://openssl-library.org/news/secadv/20260407.txt: =
https://openssl-library.org/news/secadv/20260127.txt
Note: the online version of the advisory may be updated with additional =
details over time.
For details of OpenSSL severity classifications, please =
see:
https://openssl-library.org/policies/general/security-policy/: =
https://openssl-library.org/policies/general/security-policy/
OpenSSL Corporation: https://openssl-corporation.org
, Inc. 40 East Main Street, Newark,=20
New Castle County, 19711, USA
Unsubscribe: https://api.ourmailsender4.com/api/unsubscribe?=
key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0=
ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03af6e3
| Update Profile: https://api.ourmailsender4.com/api/update?=
key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0=
ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03af6e3
| Report Junk: https://api.ourmailsender4.com/api/junk?=
key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0=
ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03af6e3
View this email in your browser: https://api.ourmailsender4.=
com/templatePreview?key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e=
029e8e85f449a76281b0ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03=
af6e3&html=3Dtrue
----_NmP-7b44d843556b7f4d-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd"><html ><head><style type=3D"text/css">=20
@font-face {
font-family: =
Inter;
src: url(https://cdn1.ourmailsender4.=
com/fonts/inter/Inter-Regular.ttf);
}
</style>
<style =
type=3D"text/css">=20
@font-face {
font-family: Play;
src: =
url(https://cdn1.ourmailsender4.com/fonts/play/Play-Regular.ttf);
}
</style>
<style type=3D"text/css">=20
=
@font-face {
font-family: Roboto;
src: url(https://cdn1.ourmailsender4.=
com/fonts/roboto/Roboto-Regular.ttf);
}
</style>
<style>a {color:#000000;=
text-decoration:underline; }
p {margin:10px 0; padding:0; }
td {border-collapse:collapse; }
body {color:#000000; width:100%; =
height:100%; margin:0; padding:0; font-size:14px; font-style:normal; =
text-align:left; font-family:arial; font-weight:normal; =
letter-spacing:normal; background-color:#FFFFFF; }
table =
{border-collapse:collapse; mso-table-lspace:0pt; mso-table-rspace:0pt; }
h1, .mph1 {color:#000000; font-size:40px; font-style:normal; =
text-align:left; font-family:arial; font-weight:bold; line-height:normal; =
letter-spacing:normal; }
h2, .mph2 {color:#000000; font-size:30px; =
font-style:normal; text-align:left; font-family:arial; font-weight:bold; =
line-height:normal; letter-spacing:normal; }
h3, .mph3 {color:#000000; =
font-size:20px; font-style:normal; text-align:left; font-family:arial; =
font-weight:normal; line-height:normal; letter-spacing:normal; }
h4, .mph4 {color:#000000; font-size:14px; font-style:italic; =
text-align:left; font-family:arial; font-weight:bold; line-height:100%; =
letter-spacing:normal; }
.mpmFButt1 {font:arial; color:#FFFFFF; =
font-size:14px; border-radius:3px; background-color:#000000; }
img, a img {border:none; outline:none; text-decoration:none; =
-ms-text-size-adjust:100%; mso-line-height-rule:exactly; =
-ms-interpolation-mode:bicubic; -webkit-text-size-adjust:100%; }
.hideInEmail {display:none; mso-hide:all; }
p, a, li, td, blockquote =
{mso-line-height-rule:exactly; }
a[href^=3Dtel], [href^=3Dsms] =
{color:inherit; cursor:default; text-decoration:none; }
a[x-apple-data-detectors] {color:inherit!important; font-size:inherit !=
important; font-family:inherit !important; font-weight:inherit !important; =
line-height:inherit !important; text-decoration:none !important; }
@media screen and (max-width: 640px) {.mobile-hide {display: none !=
important; hide-mso: all !important; }
.desktop-hide {display: revert !=
important; mso-hide: all !important; }
.responsiveTd {width: 100% !=
important; border: none !important; display: block !important; padding: 0px=
!important; max-width: 100% !important; min-width: 100% !important; =
padding-left: 0px !important; padding-right: 0px !important; }
.responsiveTbl {width: 100% !important; border: none !important; min-width:=
100% !important; }
.mobiledesktop-hide {display: none !important; =
mso-hide: all; }
}
@media screen and (min-width: 641px) {.mobile-hide =
{display: revert !important; mso-hide: none !important; }
.desktop-hide {height: auto !important; display: none !important; overflow:=
visible !important; }
.mobiledesktop-hide {display: none !important; =
mso-hide: all; }
}
p, a, li, td, body, table, blockquote =
{-ms-text-size-adjust:100%; -webkit-text-size-adjust:100%; }
h1, h2, h3, h4, h5, h6, .mph1, .mph2, .mph3, .mph4 {margin:0; =
display:block; padding:0; }
</style><title></title><meta name=3D"viewport" =
content=3D"width=3Ddevice-width, initial-scale=3D1, =
maximum-scale=3D1"/></head><body><div style=3D"display:none; =
max-height:0px; overflow:hidden; font-size:0px; line-height:0px; =
color:transparent; opacity:0; visibility:hidden; mso-hide:all;">
OpenSSL Release Announcement and Security Advisory - 7th Apr 2026
<div id=3D"preheaderpad" style=3D"display:none; max-height:0px; =
overflow:hidden; font-size:0px; line-height:0px; color:tran#sparent; =
opacity:0; visibility:hidden; mso-hide:all;"> =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=
=E2=80=8C =E2=80=8C =E2=80=8C</div>
</div>
<div style=3D"height: 0;"><img src=3D"https://api.ourmailsender4.=
com/open/image.png?key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e0=
29e8e85f449a76281b0ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03a=
f6e3" href=3D"https://api.ourmailsender4.com/openclick" title=3D"" alt=3D""=
/></div><table width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" =
class=3D"templateBody" style=3D"width: 100%; height: 100%; margin: 0; =
padding-top: 20px; padding-left: 0px; padding-right: 0px; padding-bottom: =
20px; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; " =
bgColor=3D"#FFFFFF"><tr><td valign=3D"top"><table align=3D"center" =
style=3D"width: 100%; margin: 0; max-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 20px; =
padding-left: 0px; padding-right: 0px; padding-bottom: 20px; =
background-color: #FFFFFF; -ms-text-size-adjust: 100%; =
-webkit-text-size-adjust: 100%; " valign=3D"top"><table align=3D"center" =
class=3D"" style=3D"margin: 0 auto; max-width: 100%; min-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td align=3D"center"=
style=3D"padding-top: 0px; padding-left: 0px; padding-right: 0px; =
padding-bottom: 0px; background-size: cover; background-color: #f4f4f4; =
background-image: url(); background-repeat: repeat; background-position: =
center; " width=3D"100%" valign=3D"top"><table align=3D"center" =
class=3D"responsiveTbl" width=3D"600" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td class=3D"responsiveTd" style=3D"max-width: 100%; =
padding-top: 15px; border-style: none; border-width: 1px; padding-left: =
15px; padding-right: 15px; padding-bottom: 0px; background-size: cover; =
background-color: #ffffff; background-image: url(); background-repeat: =
repeat; background-position: center; " width=3D"100%" valign=3D"top"><table=
align=3D"center" class=3D"" style=3D"max-width: 100%; min-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 0px; padding-left: 0px; padding-right: 0px; =
padding-bottom: 20px; " width=3D"100%" valign=3D"undefined"><table =
align=3D"left" style=3D"border-collapse: collapse; mso-table-lspace: 0pt; =
mso-table-rspace: 0pt; -ms-text-size-adjust: 100%; -webkit-text-size-adjust=
: 100%; " width=3D"40%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"-ms-text-size-adjust: 100%; mso-line-height-rule: exactly; =
-webkit-text-size-adjust: 100%; "><img alt=3D"" src=3D"https://cdn1.=
ourmailsender4.com/userContent/38291/fileManager/42391/OpenSSL_DarkRed_Libr=
ary.png" style=3D"border: 0; height: auto !important; margin: 0; display: =
block !important; outline: none; padding: 0; border-radius: 0; =
padding-bottom: 0; vertical-align: bottom; text-decoration: none; =
-ms-interpolation-mode: bicubic; max-width: 100%; min-width: 100%; " =
title=3D"" width=3D"228" data-custom=3D""/></td></tr></table></td></tr></ta=
ble><table align=3D"center" class=3D"" style=3D"max-width: 100%; min-width:=
100%; " width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 0; padding-left: 0; padding-right: 0; padding-bottom:=
0; " width=3D"100%"><table align=3D"center" style=3D"max-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 20px; border-width: 0; padding-left: 0px; =
padding-right: 0px; padding-bottom: 10px; background-color: transparent; " =
width=3D"100%"><div style=3D"color: #000000; position: relative; font-size:=
14px; textAlign: left; word-break: break-word; font-family: arial; =
font-weight: normal; mso-line-height-rule: exactly; line-height: =
normal;letter-spacing: normal; "><h2><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">OpenSSL =
Release Announcement and Security Advisory - 7th Apr 2026</span></h2>
<p> Release Announcement for OpenSSL Library <strong>3.6.2</strong>, =
<strong>3.5.6</strong>, <strong>3.4.5</strong>, <strong>3.3.7</strong>, =
<strong>3.0.20</strong>, <strong>1.1.1zg</strong> and <strong>1.0.=
2zp</strong></p>
<p>The OpenSSL Project team announces the release of new =
versions of our open-source toolkit for SSL/TLS.</p>
<p>Changes and CVEs fixed in 3.6.2:</p>
<ul><li><a href=3D"#CVE-2026-31790"=
target=3D"_blank" style=3D"color: #000000;">CVE-2026-31790 </a>=E2=80=94 =
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation</li><li><a =
href=3D"#CVE-2026-28386" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28386</a> =E2=80=94 Out-of-bounds Read in AES-CFB-128 on=
X86-64 with AVX-512 Support</li><li><a href=3D"#CVE-2026-28387" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28387</a> =E2=80=94 =
Potential Use-after-free in DANE Client Code</li><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li><li><a =
href=3D"#CVE-2026-31789" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31789 </a>=E2=80=94 Heap Buffer Overflow in Hexadecimal =
Conversion</li></ul>
<p>Changes and CVEs fixed in 3.5.6:</p>
<ul><li><a href=3D"#CVE-2026-31790" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31790 </a>=E2=80=94 Incorrect Failure Handling in RSA =
KEM RSASVE Encapsulation</li><li><a href=3D"#CVE-2026-28387" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28387</a> =E2=80=94 =
Potential Use-after-free in DANE Client Code</li><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li><li><a =
href=3D"#CVE-2026-31789" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31789 </a>=E2=80=94 Heap Buffer Overflow in Hexadecimal =
Conversion</li></ul>
<p>CVEs fixed in 3.4.5:</p>
<ul><li><a =
href=3D"#CVE-2026-31790" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31790 </a>=E2=80=94 Incorrect Failure Handling in RSA =
KEM RSASVE Encapsulation</li><li><a href=3D"#CVE-2026-28387" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28387</a> =E2=80=94 =
Potential Use-after-free in DANE Client Code</li><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li><li><a =
href=3D"#CVE-2026-31789" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31789 </a>=E2=80=94 Heap Buffer Overflow in Hexadecimal =
Conversion</li></ul>
<p>CVEs fixed in 3.3.7:</p>
<ul><li><a =
href=3D"#CVE-2026-31790" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31790 </a>=E2=80=94 Incorrect Failure Handling in RSA =
KEM RSASVE Encapsulation</li><li><a href=3D"#CVE-2026-28387" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28387</a> =E2=80=94 =
Potential Use-after-free in DANE Client Code</li><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li><li><a =
href=3D"#CVE-2026-31789" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31789 </a>=E2=80=94 Heap Buffer Overflow in Hexadecimal =
Conversion</li></ul>
<p>CVEs fixed in 3.0.20:</p>
<ul><li><a =
href=3D"#CVE-2026-31790" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31790 </a>=E2=80=94 Incorrect Failure Handling in RSA =
KEM RSASVE Encapsulation</li><li><a href=3D"#CVE-2026-28387" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28387</a> =E2=80=94 =
Potential Use-after-free in DANE Client Code</li><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li><li><a =
href=3D"#CVE-2026-31789" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-31789 </a>=E2=80=94 Heap Buffer Overflow in Hexadecimal =
Conversion</li></ul>
<p>CVEs fixed in 1.1.1zg: <em>(premium support =
customers only)</em></p>
<ul><li><a href=3D"#CVE-2026-28387" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28387</a> =E2=80=94 =
Potential Use-after-free in DANE Client Code</li><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li></ul>
<p>CVEs fixed in 1.0.=
2zp: <em>(premium support customers only)</em></p>
<ul><li><a =
href=3D"#CVE-2026-28388" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28388</a> =E2=80=94 NULL Pointer Dereference When =
Processing a Delta CRL</li><li><a href=3D"#CVE-2026-28389" =
target=3D"_blank" style=3D"color: #000000;">CVE-2026-28389 </a>=E2=80=94 =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</li><li=
><a href=3D"#CVE-2026-28390" target=3D"_blank" style=3D"color: =
#000000;">CVE-2026-28390</a> =E2=80=94 Possible NULL Dereference When =
Processing CMS KeyTransportRecipientInfo</li></ul>
<p>All releases contain =
miscellaneous minor bug fixes. For details of the changes, refer to the =
release notes for versions 1.0.2, 1.1.1, 3.0, 3.3, 3.4, 3.5 and 3.6.</p>
<p>Specific notes on upgrading from previous versions are available in the =
<a href=3D"https://api.ourmailsender4.com/c/830626a8ab8e3cd62763766431b3659=
8_ed0c90639b764c64e4ce205bb30183cd?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_9=
6f5394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://docs.=
openssl.org/master/man7/ossl-guide-migration/" style=3D"color: =
#000000;">OpenSSL Migration Guide</a>.</p>
<p>OpenSSL Library 3.x is =
available for download at these URLs:</p>
<ul><li><a href=3D"https://api.=
ourmailsender4.com/c/258e173554ac463e009a96c8598a62cb_dbfeed13bfeca32422b69=
cd0d6057e21?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d074=
09f7851d&aid=3DXp2h" data-mce-href=3D"https://www.openssl.org/source/" =
style=3D"color: #000000;">https://www.openssl.org/source/</a></li><li><a =
href=3D"https://api.ourmailsender4.com/c/8fbad068c07da5c7e6c796544eaf68cc_b=
26f3b4a1de55efaa89359d5744d1a06?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5=
394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://github.=
com/openssl/openssl/releases" style=3D"color: #000000;">https://github.=
com/openssl/openssl/releases</a></li></ul>
<p>The distribution file names =
are for:</p>
<ul><li>OpenSSL Library 3.6.2 - <a href=3D"https://api.=
ourmailsender4.com/c/fbb78ad4415c3afdf8372b5ffc481f60_f2972fdefa8c29378735c=
79d87ba58ae?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d074=
09f7851d&aid=3DXp2h" data-mce-href=3D"https://github.=
com/openssl/openssl/releases/tag/openssl-3.6.1" target=3D"_blank" =
style=3D"color: #000000;">openssl-3.6.2</a></li><li>OpenSSL Library 3.5.6 -=
<a href=3D"https://api.ourmailsender4.com/c/6b278e9801620fecbb5050e537fe35=
07_9df242fe2f07cc0232873ce52179ae2e?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_=
96f5394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://githu=
b.com/openssl/openssl/releases/tag/openssl-3.5.5" target=3D"_blank" =
style=3D"color: #000000;">openssl-3.5.6</a></li><li>OpenSSL Library 3.4.5 -=
<a href=3D"https://api.ourmailsender4.com/c/3d6ab2ea098864550429b49bcd5d18=
ef_e291e30c48432b4f47d91767a0c70340?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_=
96f5394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://githu=
b.com/openssl/openssl/releases/tag/openssl-3.4.4" target=3D"_blank" =
style=3D"color: #000000;">openssl-3.4.5</a></li><li>OpenSSL Library 3.3.7 -=
<a href=3D"https://api.ourmailsender4.com/c/725660d0090c2c25291146535b432c=
a7_834ba990292123bd6106313c6eb35771?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_=
96f5394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://githu=
b.com/openssl/openssl/releases/tag/openssl-3.3.6" target=3D"_blank" =
style=3D"color: #000000;">openssl-3.3.7</a></li><li>OpenSSL Library 3.0.20 =
- <a href=3D"https://api.ourmailsender4.com/c/3ee5e5906973f39537939bc8c03e0=
620_653c0e1a6077a7a1cecf4e6e80f3dc4a?sid=3Da75d05a7baeea6b4662aa75595b0d1f8=
_96f5394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://gith=
ub.com/openssl/openssl/releases/tag/openssl-3.0.19" target=3D"_blank" =
style=3D"color: #000000;">openssl-3.0.20</a></li><li>OpenSSL Library 1.1.=
1zg - <a href=3D"https://api.ourmailsender4.com/c/84b6e032b40fbfb84eafa49c8=
fb74624_1dcc24b373492147302f715a992e895d?sid=3Da75d05a7baeea6b4662aa75595b0=
d1f8_96f5394f14d40745acd5d07409f7851d&aid=3DXp2h" data-mce-href=3D"https://=
support.openssl.org/hc/en-us/articles/32874501537682-Extended-Release-1-1-1=
ze" target=3D"_blank" style=3D"color: #000000;">openssl-1.1.=
1zg</a></li><li>OpenSSL Library 1.0.2zp - <a href=3D"https://api.=
ourmailsender4.com/c/292dbf2f4cc6394d78f5941d8dcf3fc9_f25fa9033a11f8009fea1=
54b8064c052?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d074=
09f7851d&aid=3DXp2h" data-mce-href=3D"https://support.openssl.=
org/hc/en-us/articles/32874498766738-Extended-Release-1-0-2zn" =
target=3D"_blank" style=3D"color: #000000;">openssl-1.0.2zp</a></li></ul>
<hr>
<h2><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">Security Advisory - 7th=
April 2026<br></span></h2>
<p> </p>
<h3><b><a name=3D"CVE-2026-31790"=
id=3D"CVE-2026-31790" href=3D"#CVE-2026-31790" style=3D"color: =
#000000;"></a>CVE-2026-31790 - Incorrect Failure Handling in RSA KEM RSASVE=
Encapsulation</b><br></h3>
<p><b><em>Link for this security =
advisory: </em><a href=3D"https://api.ourmailsender4.=
com/c/7ad27eb61e663e2a46ec8632639621fe_6c20e703313eeb3a38d6505dc189aebb?=
sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d07409f7851d&aid=
=3DXp2h" target=3D"_blank" rel=3D"noopener" data-mce-href=3D"https://www.=
openssl.org/news/vulnerabilities.html#CVE-2025-11187" style=3D"color: =
#000000;">CVE-2026-31790</a></b></p>
<p><b>Severity</b>: Moderate</p>
<p><b>Issue summary</b>: Applications using RSASVE key encapsulation to =
establish a secret encryption key can send contents of an uninitialized =
memory buffer to a malicious peer.</p>
<p><b>Impact summary</b>: The =
uninitialized buffer might contain sensitive data from the previous =
execution of the application process which leads to sensitive data leakage =
to an attacker.</p>
<p>RSA_public_encrypt() returns the number of bytes =
written on success and -1 on error. The affected code tests only whether =
the return value is non-zero. As a result, if RSA encryption fails, =
encapsulation can still return success to the caller, set the output =
lengths, and leave the caller to use the contents of the ciphertext buffer =
as if a valid KEM ciphertext had been produced.</p>
<p>If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an =
attacker-supplied invalid RSA public key without first validating that key,=
then this may cause stale or uninitialized contents of the caller-provided=
ciphertext buffer to be disclosed to the attacker in place of the KEM =
ciphertext.</p>
<p>As a workaround calling EVP_PKEY_public_check() or =
EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate =
the issue.</p>
<p>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are =
affected by this issue.</p>
<p>OpenSSL 1.0.2 and 1.1.1 are not affected by =
this issue.<br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 are vulnerable to this issue=
.<br>OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.<br>OpenSSL 3.3 =
users should upgrade to OpenSSL 3.3.7.<br>OpenSSL 3.4 users should upgrade =
to OpenSSL 3.4.5.<br>OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.=
<br>OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2.</p>
<p>This issue was reported by Simo Sorce (Red Hat) on 23rd Feburary 2026.=
<br>The fix was developed by Nikola Pajkovsky.</p>
<p> </p>
<h3><b><a name=3D"CVE-2026-28386" id=3D"CVE-2026-28386" =
href=3D"#CVE-2026-28386" style=3D"color: #000000;"></a>CVE-2026-28386 - =
Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 =
Support</b><br></h3>
<p><b><em>Link for this security =
advisory: </em><a href=3D"https://api.ourmailsender4.=
com/c/81dd31e3723ea8a870f80abc17948497_ab652181ca0566a93d829b1bc53c3063?=
sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d07409f7851d&aid=
=3DXp2h" target=3D"_blank" rel=3D"noopener" data-mce-href=3D"https://www.=
openssl.org/news/vulnerabilities.html#CVE-2025-11187" style=3D"color: =
#000000;">CVE-2026-28386</a></b></p>
<p><b>Severity</b>: Low</p>
<p><b>Issue summary</b>: Applications using AES-CFB128 encryption or =
decryption on systems with AVX-512 and VAES support can trigger an =
out-of-bounds read of up to 15 bytes when processing partial cipher blocks.=
</p>
<p><b>Impact summary</b>: This out-of-bounds read may trigger a crash =
which leads to Denial of Service for an application if the input buffer =
ends at a memory page boundary and the following page is unmapped. There is=
no information disclosure as the over-read bytes are not written to output=
.</p>
<p>The vulnerable code path is only reached when processing partial =
blocks (when a previous call left an incomplete block and the current call =
provides fewer bytes than needed to complete it). Additionally, the input =
buffer must be positioned at a page boundary with the following page =
unmapped. CFB mode is not used in TLS/DTLS protocols, which use CBC, GCM, =
CCM, or ChaCha20-Poly1305 instead. For these reasons the issue was assessed=
as<br>Low severity according to our Security Policy.</p>
<p>Only x86-64 systems with AVX-512 and VAES instruction support are =
affected. Other architectures and systems without VAES support use =
different code paths that are not affected.</p>
<p>OpenSSL FIPS module in 3=
.6 version is affected by this issue.</p>
<p>OpenSSL 3.0, 3.3, 3.4, 3.5, 1.=
1.1 and 1.0.2 are not vulnerable to this issue.<br>OpenSSL 3.6 is =
vulnerable to this issue.<br>OpenSSL 3.6 users should upgrade to OpenSSL 3.=
6.2.</p>
<p>This issue was reported on 6th January 2026 by Stanislav Fort =
and Pavel Kohout<br>(Aisle Research).<br>The fix was developed by Stanislav=
Fort and Pavel Kohout (Aisle Research).<br>It was independently reported =
on 10th March 2026 by Alex Gaynor (Anthropic).</p>
<p> </p>
<h3><b><a name=3D"CVE-2026-28387" id=3D"CVE-2026-28387" =
href=3D"#CVE-2026-28387" style=3D"color: #000000;"></a>CVE-2026-28387 - =
Potential Use-after-free in DANE Client Code</b><br></h3>
<p><b><em>Link for this security advisory: </em><a href=3D"https://api=
.ourmailsender4.com/c/b95ad4c86250bcddaa6757973e02dd56_a5f36821cbeaa0633a84=
95d20c238690?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d07=
409f7851d&aid=3DXp2h" target=3D"_blank" rel=3D"noopener" =
data-mce-href=3D"https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-11187" style=3D"color: #000000;">CVE-2026-28387</a></b></p>
<p><b>Severity</b>: Low</p>
<p><b>Issue summary</b>: An uncommon =
configuration of clients performing DANE TLSA-based server authentication, =
when paired with uncommon server DANE TLSA records, may result in a =
use-after-free and/or double-free on the client side.</p>
<p><b>Impact summary</b>: A use after free can have a range of potential =
consequences such as the corruption of valid data, crashes or execution of =
arbitrary code.</p>
<p>However, the issue only affects clients that make =
use of TLSA records with both the PKIX TA(0/PKIX-EE(1) certificate usages =
and the DANE-TA(2) certificate usage.</p>
<p>By far the most common =
deployment of DANE is in SMTP MTAs for which RFC7672 recommends that =
clients treat as "unusable" any TLSA records that have the PKIX certificate=
usages. These SMTP (or other similar) clients are not vulnerable to =
this issue. Conversely, any clients that support only the PKIX usages, and =
ignore the DANE-TA(2) usage are also not vulnerable.</p>
<p>The client would also need to be communicating with a server that =
publishes a TLSA RRset with both types of TLSA records.</p>
<p>No FIPS modules are affected by this issue, the problem code is outside =
the<br>FIPS module boundary.</p>
<p>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1=
.1 are vulnerable to this issue.<br>OpenSSL 1.0.2 is not affected by this =
issue.<br>OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2.<br>OpenSSL 3.5=
users should upgrade to OpenSSL 3.5.6.<br>OpenSSL 3.4 users should upgrade=
to OpenSSL 3.4.5.<br>OpenSSL 3.3 users should upgrade to OpenSSL 3.3.7.=
<br>OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.<br>OpenSSL 1.1.1 =
users should upgrade to OpenSSL 1.1.1zg (premium<br>support customers only)=
.</p>
<p>This issue was reported on the 8th of January 2026 by Igor =
Morgenstern (Aisle Research). The fix was developed by Viktor Dukhovni and =
Alexandr Nedvedicky.</p>
<p> </p>
<h3><b><a name=3D"CVE-2026-28388" =
id=3D"CVE-2026-28388" href=3D"#CVE-2026-28388" style=3D"color: =
#000000;"></a>CVE-2026-28388 - NULL Pointer Dereference When Processing a =
Delta CRL</b><br></h3>
<p><b><em>Link for this security =
advisory: </em><a href=3D"https://api.ourmailsender4.=
com/c/6b69cbf12c182c9500bea2afbb2d9a29_24402d92ee4b25be351d713adc19895b?=
sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d07409f7851d&aid=
=3DXp2h" target=3D"_blank" rel=3D"noopener" data-mce-href=3D"https://www.=
openssl.org/news/vulnerabilities.html#CVE-2025-11187" style=3D"color: =
#000000;">CVE-2026-28388</a></b></p>
<p><b>Severity</b>: Low</p>
<p><b>Issue summary</b>: When a delta CRL that contains a Delta CRL =
Indicator extension is processed a NULL pointer dereference might happen if=
the required CRL Number extension is missing.</p>
<p><b>Impact =
summary</b>: A NULL pointer dereference can trigger a crash which leads to =
a Denial of Service for an application.</p>
<p>When CRL processing and =
delta CRL processing is enabled during X.509 certificate verification, the =
delta CRL processing does not check whether the CRL Number extension is =
NULL before dereferencing it. When a malformed delta CRL file is being =
processed, this parameter can be NULL, causing a NULL pointer dereference.=
</p>
<p>Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to =
be enabled in the verification context, the certificate being verified to =
contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST=
flag set, and an attacker to provide a malformed CRL to an application =
that processes it.</p>
<p>The vulnerability is limited to Denial of Service=
and cannot be escalated to achieve code execution or memory disclosure. =
For that reason the issue was assessed as Low severity according to our =
Security Policy.</p>
<p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are =
not affected by this issue,<br>as the affected code is outside the OpenSSL =
FIPS module boundary.</p>
<p>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0=
.2 are vulnerable to this issue.<br>OpenSSL 3.6 users should upgrade to =
OpenSSL 3.6.2.<br>OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.=
<br>OpenSSL 3.4 users should upgrade to OpenSSL 3.4.5.<br>OpenSSL 3.3 users=
should upgrade to OpenSSL 3.3.7.<br>OpenSSL 3.0 users should upgrade to =
OpenSSL 3.0.20.<br>OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.=
1zg<br>(premium support customers only).<br>OpenSSL 1.0.2 users should =
upgrade to OpenSSL 1.0.2zp<br>(premium support customers only).</p>
<p>This issue was reported on 8th January 2026 by Igor Morgenstern (Aisle =
Research). <br>The fix was developed by Igor Morgenstern (Aisle Research).=
</p>
<p> </p>
<h3><b><a name=3D"CVE-2026-28389" id=3D"CVE-2026-28389" =
href=3D"#CVE-2026-28389" style=3D"color: #000000;"></a>CVE-2026-28389 - =
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo</b><br>=
</h3>
<p><b><em>Link for this security advisory: </em><a =
href=3D"https://api.ourmailsender4.com/c/942572416d2c331b6f461a171670e5e8_7=
9105324cf9f537c2f25ca2e762c20e3?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5=
394f14d40745acd5d07409f7851d&aid=3DXp2h" target=3D"_blank" rel=3D"noopener"=
data-mce-href=3D"https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-11187" style=3D"color: #000000;">CVE-2026-28389</a></b></p>
<p><b>Severity</b>: Low</p>
<p><b>Issue summary</b>: During processing of a=
crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL =
pointer dereference can happen.</p>
<p><b>Impact summary</b>: Applications =
that process attacker-controlled CMS data may crash before authentication =
or cryptographic operations occur resulting in Denial of Service.</p>
<p>When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is =
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifie=
r is examined without checking for its presence. This results in a NULL =
pointer dereference if the field is missing.</p>
<p>Applications and =
services that call CMS_decrypt() on untrusted input (e.g., S/MIME =
processing or CMS-based protocols) are vulnerable.</p>
<p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by =
this<br>issue, as the affected code is outside the OpenSSL FIPS module =
boundary.</p>
<p>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are =
vulnerable to this issue.<br>OpenSSL 3.6 users should upgrade to OpenSSL 3.=
6.2.<br>OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.<br>OpenSSL 3.4 =
users should upgrade to OpenSSL 3.4.5.<br>OpenSSL 3.3 users should upgrade =
to OpenSSL 3.3.7.<br>OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.=
<br>OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zg.<br>(premium =
support customers only).<br>OpenSSL 1.0.2 users should upgrade to OpenSSL 1=
.0.2zp.<br>(premium support customers only).</p>
<p>This issue was reported=
on 13th February 2026 by Nathan Sportsman (Praetorian), on 25th February =
2026 by Daniel Rhea, on 15th March 2026 by Jaeho Nam (Seoul National =
University), on 26th March 2026 by Muhammad Daffa, on 27th March 2026 by =
Zhanpeng Liu (Tencent Xuanwu Lab), Guannan Wang (Tencent Xuanwu Lab) and =
Guancheng Li (Tencent Xuanwu Lab) and on 30th March 2026 by Joshua Rogers.=
<br>The fix was developed by Neil Horman.</p>
<p> </p>
<h3><b><a name=3D"CVE-2026-28390" id=3D"CVE-2026-28390" =
href=3D"#CVE-2026-28390" style=3D"color: #000000;"></a>CVE-2026-28390 - =
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo</b>=
<br></h3>
<p><b><em>Link for this security advisory: </em><a =
href=3D"https://api.ourmailsender4.com/c/af8a6fe07826b47141449bb6e412f2e7_a=
413f143dfee3d79b9182c3341cfc2e5?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5=
394f14d40745acd5d07409f7851d&aid=3DXp2h" target=3D"_blank" rel=3D"noopener"=
data-mce-href=3D"https://www.openssl.org/news/vulnerabilities.=
html#CVE-2025-11187" style=3D"color: #000000;">CVE-2026-28390</a></b></p>
<p><b>Severity</b>: Low</p>
<p><b>Issue summary</b>: During processing of a=
crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL =
pointer dereference can happen.</p>
<p><b>Impact summary</b>: Applications =
that process attacker-controlled CMS data may crash before authentication =
or cryptographic operations occur resulting in Denial of Service.</p>
<p>When a CMS EnvelopedData message that uses KeyTransportRecipientInfo =
with RSA-OAEP encryption is processed, the optional parameters field of =
RSA-OAEP SourceFunc algorithm identifier is examined without checking for =
its presence. This results in a NULL pointer dereference if the field is =
missing.</p>
<p>Applications and services that call CMS_decrypt() on =
untrusted input (e.g., S/MIME processing or CMS-based protocols) are =
vulnerable.</p>
<p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not =
affected by this issue, as the affected code is outside the OpenSSL FIPS =
module boundary.</p>
<p>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 =
are vulnerable to this issue.<br>OpenSSL 3.6 users should upgrade to =
OpenSSL 3.6.2.<br>OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.=
<br>OpenSSL 3.4 users should upgrade to OpenSSL 3.4.5.<br>OpenSSL 3.3 users=
should upgrade to OpenSSL 3.3.7.<br>OpenSSL 3.0 users should upgrade to =
OpenSSL 3.0.20.<br>OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zg.=
<br>(premium support customers only).<br>OpenSSL 1.0.2 users should upgrade=
to OpenSSL 1.0.2zp.<br>(premium support customers only).</p>
<p>This issue was reported on 26th March 2026 by Muhammad Daffa, on 27th =
March 2026 by Zhanpeng Liu (Tencent Xuanwu Lab), Guannan Wang (Tencent =
Xuanwu Lab) and Guancheng Li (Tencent Xuanwu Lab), on 30th March 2026 by =
Joshua Rogers and on 31st March 2026 by Chanho Kim. <br>The fix was =
developed by Neil Horman.</p>
<p> </p>
<h3><b><a =
name=3D"CVE-2026-31789" id=3D"CVE-2026-31789" href=3D"#CVE-2026-31789" =
style=3D"color: #000000;"></a>CVE-2026-31789 - Heap Buffer Overflow in =
Hexadecimal Conversion</b><br></h3>
<p><b><em>Link for this security =
advisory: </em><a href=3D"https://api.ourmailsender4.=
com/c/90dee83f12d2136e156f55a318a08f4b_436cfe247de0101ad9d3e0856514db3c?=
sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d07409f7851d&aid=
=3DXp2h" target=3D"_blank" rel=3D"noopener" data-mce-href=3D"https://www.=
openssl.org/news/vulnerabilities.html#CVE-2025-11187" style=3D"color: =
#000000;">CVE-2026-31789</a></b></p>
<p><b>Severity</b>: Low</p>
<p><b>Issue summary</b>: Converting an excessively large OCTET STRING value=
to a hexadecimal string leads to a heap buffer overflow on 32 bit =
platforms.</p>
<p><b>Impact summary</b>: A heap buffer overflow may lead to=
a crash or possibly an attacker controlled code execution or other =
undefined behavior.</p>
<p>If an attacker can supply a crafted X.509 =
certificate with an excessively large OCTET STRING value in extensions such=
as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) =
which are being converted to hex, the size of the buffer needed for the =
result is calculated as multiplication of the input length by 3. On 32 bit =
platforms, this multiplication may overflow resulting in the allocation of =
a smaller buffer and a heap buffer overflow.</p>
<p>Applications and =
services that print or log contents of untrusted X.509 certificates are =
vulnerable to this issue. As the certificates would have to have sizes of =
over 1 Gigabyte, printing or logging such certificates is a fairly unlikely=
operation and only 32 bit platforms are affected, this issue was assigned =
Low severity.</p>
<p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not=
affected by this<br>issue, as the affected code is outside the OpenSSL =
FIPS module boundary.</p>
<p>OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are =
vulnerable to this issue.<br>OpenSSL 1.1.1 and 1.0.2 are not affected by =
this issue.<br>OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2.=
<br>OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6.<br>OpenSSL 3.4 users=
should upgrade to OpenSSL 3.4.5.<br>OpenSSL 3.3 users should upgrade to =
OpenSSL 3.3.7.<br>OpenSSL 3.0 users should upgrade to OpenSSL 3.0.20.</p>
<p>This issue was reported on 16th February 2026 by Quoc Tran (<a =
href=3D"https://api.ourmailsender4.com/c/80d95aed8af32d5bb3fd7029b07c33f2_2=
a4f8cf49e7ccab41204db7d3ad7d296?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5=
394f14d40745acd5d07409f7851d&aid=3DXp2h" style=3D"color: #000000;">Xint.=
io</a> - US Team).<br>The fix was developed by Igor Ustinov.=
<b><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">General Advisory =
Notes</span></b></p>
<p><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;">URL for =
this Security Advisory:</span><br><span style=3D"font-family: Roboto, =
sans-serif;" data-mce-style=3D"font-family: Roboto, sans-serif;"><a =
href=3D"https://api.ourmailsender4.com/c/0dd9ddaf2af3e5a8fbdbe86706b9aec6_6=
111c610345622e2a297fb26bf815458?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5=
394f14d40745acd5d07409f7851d&aid=3DXp2h" target=3D"_blank" rel=3D"noopener"=
data-mce-href=3D"https://openssl-library.org/news/secadv/20260127.txt" =
style=3D"color: #000000;">https://openssl-library.org/news/secadv/20260407.=
txt</a></span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">Note: the online =
version of the advisory may be updated with additional details over =
time.</span><br><br><span style=3D"font-family: Roboto, sans-serif;" =
data-mce-style=3D"font-family: Roboto, sans-serif;">For details of OpenSSL =
severity classifications, please see:</span><br><span style=3D"font-family:=
Roboto, sans-serif;" data-mce-style=3D"font-family: Roboto, =
sans-serif;"><a href=3D"https://api.ourmailsender4.com/c/23444c494027dcb306=
f204b2c906a71c_ee26e3ff5395fac0528488ce1304bc3e?sid=3Da75d05a7baeea6b4662aa=
75595b0d1f8_96f5394f14d40745acd5d07409f7851d&aid=3DXp2h" =
data-mce-href=3D"https://openssl-library.org/policies/general/security-poli=
cy/" style=3D"color: #000000;">https://openssl-library.=
org/policies/general/security-policy/</a></span></p></div></td></tr></table=
></td></tr></table><table align=3D"center" class=3D"" style=3D"max-width: =
100%; min-width: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td align=3D"center" style=3D"padding-top: 0px; =
padding-left: 0px; padding-right: 0px; padding-bottom: 20px; =
background-color: transparent; " width=3D"100%" valign=3D"top"><table =
align=3D"center" style=3D"min-width: 100%; border-collapse: collapse; =
border-top-color: #f4f4f4; border-top-style: solid; border-top-width: 2px; =
mso-table-lspace: 0pt; mso-table-rspace: 0pt; -ms-text-size-adjust: 100%; =
-webkit-text-size-adjust: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td style=3D"-ms-text-size-adjust: 100%; =
mso-line-height-rule: exactly; -webkit-text-size-adjust: 100%; =
"><span/></td></tr></table></td></tr></table><table align=3D"center" =
class=3D"" style=3D"max-width: 100%; min-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 0; =
padding-left: 0; padding-right: 0; padding-bottom: 0; " =
width=3D"100%"><table align=3D"center" style=3D"max-width: 100%; " =
width=3D"100%" cellPadding=3D"0" cellSpacing=3D"0"><tr><td =
style=3D"padding-top: 0px; border-width: 0; padding-left: 0px; =
padding-right: 0px; padding-bottom: 10px; background-color: transparent; " =
width=3D"100%"><div style=3D"color: #000000; position: relative; font-size:=
14px; textAlign: left; word-break: break-word; font-family: arial; =
font-weight: normal; mso-line-height-rule: exactly; line-height: =
normal;letter-spacing: normal; "><div style=3D"text-align: center;" =
data-mce-style=3D"text-align: center;"><a href=3D"https://api.=
ourmailsender4.com/c/2aeefcd0332b4efc833f27458c0e69b2_37c801838c458436e8538=
0d9713bcbe7?sid=3Da75d05a7baeea6b4662aa75595b0d1f8_96f5394f14d40745acd5d074=
09f7851d&aid=3DXp2h" target=3D"_blank" rel=3D"noopener" =
data-mce-href=3D"https://openssl-corporation.org" style=3D"color: =
#000000;">OpenSSL Corporation</a>, Inc. 40 East Main Street, Newark, =
<br>New Castle County, 19711, USA</div></div></td></tr></table></td></tr></=
table><table align=3D"center" class=3D"" style=3D"max-width: 100%; =
min-width: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td style=3D"padding-top: 0px; padding-left: 0px; =
padding-right: 0px; padding-bottom: 0px; " width=3D"100%"><table =
align=3D"center" style=3D"max-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 0px; =
padding-left: 0px; padding-right: 0px; padding-bottom: 10px; =
background-color: transparent; " width=3D"100%"><div style=3D"color: =
#000000; position: relative; font-size: 14px; textAlign: left; word-break: =
break-word; font-family: arial; font-weight: normal; mso-line-height-rule: =
exactly; line-height: normal;letter-spacing: normal; "><div =
style=3D"text-align: center;" data-mce-style=3D"text-align: center;"><span =
style=3D"background-color: transparent;" data-mce-style=3D"background-color=
: transparent;"><a href=3D"https://api.ourmailsender4.com/api/unsubscribe?=
key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0=
ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03af6e3" =
data-mce-href=3D"https://api.ourmailsender4.com/api/unsubscribe?=
key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0=
ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03af6e3" =
style=3D"color: #000000;">Unsubscribe</a> | <a =
href=3D"https://api.ourmailsender4.com/api/update?key=3Dfd6bffb5b1037b700f8=
87b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0ea56c68f816121382113ee10b=
30_38c0cec0dd6226962963c8d1c03af6e3" data-mce-href=3D"https://api.=
ourmailsender4.com/api/update?key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebca=
c4feb8fd8e029e8e85f449a76281b0ea56c68f816121382113ee10b30_38c0cec0dd6226962=
963c8d1c03af6e3" style=3D"color: #000000;">Update Profile</a> | <=
a href=3D"https://api.ourmailsender4.com/api/junk?key=3Dfd6bffb5b1037b700f8=
87b56ef00a06f348ebcac4feb8fd8e029e8e85f449a76281b0ea56c68f816121382113ee10b=
30_38c0cec0dd6226962963c8d1c03af6e3" data-mce-href=3D"https://api.=
ourmailsender4.com/api/junk?key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4=
feb8fd8e029e8e85f449a76281b0ea56c68f816121382113ee10b30_38c0cec0dd622696296=
3c8d1c03af6e3" data-mce-selected=3D"inline-boundary" style=3D"color: =
#000000;">Report Junk</a></span></div></div></td></tr></table></td></tr></t=
able><table align=3D"center" class=3D"" style=3D"max-width: 100%; =
min-width: 100%; " width=3D"100%" cellPadding=3D"0" =
cellSpacing=3D"0"><tr><td style=3D"padding-top: 0; padding-left: 0; =
padding-right: 0; padding-bottom: 0; " width=3D"100%"><table =
align=3D"center" style=3D"max-width: 100%; " width=3D"100%" =
cellPadding=3D"0" cellSpacing=3D"0"><tr><td style=3D"padding-top: 0px; =
border-width: 0; padding-left: 0px; padding-right: 0px; padding-bottom: =
20px; background-color: transparent; " width=3D"100%"><div style=3D"color: =
#000000; position: relative; font-size: 14px; textAlign: left; word-break: =
break-word; font-family: arial; font-weight: normal; mso-line-height-rule: =
exactly; line-height: normal;letter-spacing: normal; "><div =
style=3D"text-align: center;"><a href=3D"https://api.ourmailsender4.=
com/templatePreview?key=3Dfd6bffb5b1037b700f887b56ef00a06f348ebcac4feb8fd8e=
029e8e85f449a76281b0ea56c68f816121382113ee10b30_38c0cec0dd6226962963c8d1c03=
af6e3&html=3Dtrue" target=3D"_blank" rel=3D"noopener" style=3D"color: =
#000000;">View this email in your browser</a></div></div></td></tr></table>=
</td></tr></table></td></tr></table></td></tr></table></td></tr></table></t=
d></tr></table></body></html>
----_NmP-7b44d843556b7f4d-Part_1--