CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-31790 – Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
https://notcve.org/view.php?id=CVE-2026-31790
07 Apr 2026 — Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result,... • https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2026-31789 – Heap Buffer Overflow in Hexadecimal Conversion
https://notcve.org/view.php?id=CVE-2026-31789
07 Apr 2026 — Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the siz... • https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28390 – Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
https://notcve.org/view.php?id=CVE-2026-28390
07 Apr 2026 — Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without... • https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28389 – Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
https://notcve.org/view.php?id=CVE-2026-28389
07 Apr 2026 — Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results ... • https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28388 – NULL Pointer Dereference When Processing a Delta CRL
https://notcve.org/view.php?id=CVE-2026-28388
07 Apr 2026 — Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malfor... • https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e • CWE-476: NULL Pointer Dereference •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28387 – Potential Use-after-free in DANE Client Code
https://notcve.org/view.php?id=CVE-2026-28387
07 Apr 2026 — Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DA... • https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b • CWE-416: Use After Free •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 2CVE-2025-15467 – Stack buffer overflow in CMS (Auth)EnvelopedData parsing
https://notcve.org/view.php?id=CVE-2025-15467
27 Jan 2026 — Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacke... • https://packetstorm.news/files/id/214573 • CWE-787: Out-of-bounds Write •
CVSS: 4.9EPSS: 0%CPEs: 5EXPL: 1CVE-2025-68160 – Heap out-of-bounds write in BIO_f_linebuffer on short writes
https://notcve.org/view.php?id=CVE-2025-68160
27 Jan 2026 — Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/s... • https://packetstorm.news/files/id/215529 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2026-22795 – Missing ASN1_TYPE validation in PKCS#12 parsing
https://notcve.org/view.php?id=CVE-2026-22795
27 Jan 2026 — Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte addre... • https://packetstorm.news/files/id/215529 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 1CVE-2026-22796 – ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
https://notcve.org/view.php?id=CVE-2026-22796
27 Jan 2026 — Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Ser... • https://packetstorm.news/files/id/215529 • CWE-754: Improper Check for Unusual or Exceptional Conditions •