CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-31790 – Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
https://notcve.org/view.php?id=CVE-2026-31790
07 Apr 2026 — Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result,... • https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2026-31789 – Heap Buffer Overflow in Hexadecimal Conversion
https://notcve.org/view.php?id=CVE-2026-31789
07 Apr 2026 — Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the siz... • https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28390 – Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
https://notcve.org/view.php?id=CVE-2026-28390
07 Apr 2026 — Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without... • https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28389 – Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
https://notcve.org/view.php?id=CVE-2026-28389
07 Apr 2026 — Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results ... • https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28388 – NULL Pointer Dereference When Processing a Delta CRL
https://notcve.org/view.php?id=CVE-2026-28388
07 Apr 2026 — Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malfor... • https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e • CWE-476: NULL Pointer Dereference •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28387 – Potential Use-after-free in DANE Client Code
https://notcve.org/view.php?id=CVE-2026-28387
07 Apr 2026 — Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DA... • https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b • CWE-416: Use After Free •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 2CVE-2025-15467 – Stack buffer overflow in CMS (Auth)EnvelopedData parsing
https://notcve.org/view.php?id=CVE-2025-15467
27 Jan 2026 — Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacke... • https://packetstorm.news/files/id/214573 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2025-15468 – NULL dereference in SSL_CIPHER_find() function on unknown cipher ID
https://notcve.org/view.php?id=CVE-2025-15468
27 Jan 2026 — Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference ... • https://packetstorm.news/files/id/215529 • CWE-476: NULL Pointer Dereference •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 1CVE-2025-66199 – TLS 1.3 CompressedCertificate excessive memory allocation
https://notcve.org/view.php?id=CVE-2025-66199
27 Jan 2026 — Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCertificate mess... • https://packetstorm.news/files/id/215529 • CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 4.9EPSS: 0%CPEs: 5EXPL: 1CVE-2025-68160 – Heap out-of-bounds write in BIO_f_linebuffer on short writes
https://notcve.org/view.php?id=CVE-2025-68160
27 Jan 2026 — Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/s... • https://packetstorm.news/files/id/215529 • CWE-787: Out-of-bounds Write •