https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:28:58 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10553 bdu:2026-10553 https://cve.radiocsirt.org/vuln/bdu:2026-10553 https://cve.radiocsirt.org/vuln/bell-cve-2026-28388 <p><strong>Affected:</strong> Alpaquita:23: openssl, Alpaquita:25: openssl, Alpaquita:stream: openssl, BellSoft Hardened Containers:23: openssl, BellSoft Hardened Containers:25: openssl, BellSoft Hardened Containers:stream: openssl</p> <p><strong>Affected:</strong> Alpaquita:23: openssl, Alpaquita:25: openssl, Alpaquita:stream: openssl, BellSoft Hardened Containers:23: openssl, BellSoft Hardened Containers:25: openssl, BellSoft Hardened Containers:stream: openssl</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-28388 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0403 certfr-2026-avi-0403 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0403 https://cve.radiocsirt.org/vuln/euvd-2026-317201 EUVD-2026-317201 https://cve.radiocsirt.org/vuln/euvd-2026-317201 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28388 <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.</p> <p>Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.</p> <p>The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.</p> <p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.</p> <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.</p> <p>Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.</p> <p>The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.</p> <p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28388 https://cve.radiocsirt.org/vuln/ghsa-rpg5-467j-c25q <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.</p> <p>Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.</p> <p>The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.</p> <p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.</p> <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.</p> <p>Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.</p> <p>The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.</p> <p>The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.</p> https://cve.radiocsirt.org/vuln/ghsa-rpg5-467j-c25q https://cve.radiocsirt.org/vuln/icsa-24-102-01 <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> https://cve.radiocsirt.org/vuln/icsa-24-102-01 https://cve.radiocsirt.org/vuln/msrc_cve-2026-28388 msrc_CVE-2026-28388 https://cve.radiocsirt.org/vuln/msrc_cve-2026-28388 https://cve.radiocsirt.org/vuln/ncsc-2026-0147 NCSC-2026-0147 https://cve.radiocsirt.org/vuln/ncsc-2026-0147 https://cve.radiocsirt.org/vuln/oesa-2026-2041 <p><strong>Affected:</strong> openEuler:24.03-LTS: openssl</p> <p>Security Fix(es):</p> <p>Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.</p> <p>Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.</p> <p>However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.</p> <p>By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as &amp;apos;unusable&amp;apos; any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.</p> <p>The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.</p> <p>No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.(CVE-2026-28387)</p> <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When CRL processing an…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: openssl</p> <p>Security Fix(es):</p> <p>Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.</p> <p>Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.</p> <p>However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.</p> <p>By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as &amp;apos;unusable&amp;apos; any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.</p> <p>The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.</p> <p>No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.(CVE-2026-28387)</p> <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When CRL processing an…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2041 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10533-1 <p>libopenssl-3-devel-3.5.3-4.1 on GA media</p> <p>libopenssl-3-devel-3.5.3-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10533-1 https://cve.radiocsirt.org/vuln/rhsa-2026:7261 <p>openssl: Out-of-bounds read &amp; write in RFC 3211 KEK Unwrap openssl: Timing side-channel in SM2 algorithm on 64 bit ARM openssl: Out-of-bounds read in HTTP client no_proxy handling openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing openssl: OpenSSL: Denial of Service via malformed TimeStamp Response openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification openssl: openssl: Denial of Service due to out-of-bounds read in AES-CFB128 openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLS…</p> <p>openssl: Out-of-bounds read &amp; write in RFC 3211 KEK Unwrap openssl: Timing side-channel in SM2 algorithm on 64 bit ARM openssl: Out-of-bounds read in HTTP client no_proxy handling openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing openssl: OpenSSL: Denial of Service via malformed TimeStamp Response openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification openssl: openssl: Denial of Service due to out-of-bounds read in AES-CFB128 openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLS…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7261 https://cve.radiocsirt.org/vuln/ssa-032379 <p>In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res-&gt;hpo_dp_link_enc before using it [WHAT &amp; HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity. In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs: relax assertions on failure to encode file handles</p> <p>Encoding file handles is usually performed by a filesystem &gt;encode_fh() method that may fail for various reasons.</p> <p>The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle.</p> <p>There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when -&gt;encode_fh() fails. Relax those assertions because they are wrong.</p> <p>The second linked bug report states commit 16aac5ad1fa9 (&#34;ovl: support encoding non-decodable file handles&#34;) in v6.6 as the regressing commit, but this is not accurate.</p> <p>The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches.</p> <p>Triggering this assertion was always possible with other filesystems and other reasons of -&gt;encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlay…</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res-&gt;hpo_dp_link_enc before using it [WHAT &amp; HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity. In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs: relax assertions on failure to encode file handles</p> <p>Encoding file handles is usually performed by a filesystem &gt;encode_fh() method that may fail for various reasons.</p> <p>The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle.</p> <p>There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when -&gt;encode_fh() fails. Relax those assertions because they are wrong.</p> <p>The second linked bug report states commit 16aac5ad1fa9 (&#34;ovl: support encoding non-decodable file handles&#34;) in v6.6 as the regressing commit, but this is not accurate.</p> <p>The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches.</p> <p>Triggering this assertion was always possible with other filesystems and other reasons of -&gt;encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlay…</p> https://cve.radiocsirt.org/vuln/ssa-032379 https://cve.radiocsirt.org/vuln/suse-su-2026:1213-1 <p>Security update for openssl-3</p> <p>Security update for openssl-3</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1213-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-28388 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: openssl, Ubuntu:Pro:16.04:LTS: openssl, Ubuntu:Pro:16.04:LTS: edk2, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:FIPS:16.04:LTS: openssl, Ubuntu:Pro:18.04:LTS: openssl, Ubuntu:Pro:18.04:LTS: openssl1.0, Ubuntu:Pro:18.04:LTS: edk2, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:FIPS-updates:18.04:LTS: openssl and 20 more</p> <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta…</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: openssl, Ubuntu:Pro:16.04:LTS: openssl, Ubuntu:Pro:16.04:LTS: edk2, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:FIPS:16.04:LTS: openssl, Ubuntu:Pro:18.04:LTS: openssl, Ubuntu:Pro:18.04:LTS: openssl1.0, Ubuntu:Pro:18.04:LTS: edk2, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:FIPS-updates:18.04:LTS: openssl and 20 more</p> <p>Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-28388 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0995 <p>Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0995