CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-31790 – Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
https://notcve.org/view.php?id=CVE-2026-31790
07 Apr 2026 — Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result,... • https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5ac • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2026-31789 – Heap Buffer Overflow in Hexadecimal Conversion
https://notcve.org/view.php?id=CVE-2026-31789
07 Apr 2026 — Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the siz... • https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28390 – Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
https://notcve.org/view.php?id=CVE-2026-28390
07 Apr 2026 — Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without... • https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28389 – Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
https://notcve.org/view.php?id=CVE-2026-28389
07 Apr 2026 — Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results ... • https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28388 – NULL Pointer Dereference When Processing a Delta CRL
https://notcve.org/view.php?id=CVE-2026-28388
07 Apr 2026 — Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malfor... • https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e • CWE-476: NULL Pointer Dereference •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2026-28387 – Potential Use-after-free in DANE Client Code
https://notcve.org/view.php?id=CVE-2026-28387
07 Apr 2026 — Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DA... • https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2026-2673 – OpenSSL TLS 1.3 server may choose unexpected key agreement group
https://notcve.org/view.php?id=CVE-2026-2673
13 Mar 2026 — Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defe... • https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f • CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2025-15469 – 'openssl dgst' one-shot codepath silently truncates inputs >16MB
https://notcve.org/view.php?id=CVE-2025-15469
27 Jan 2026 — Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains unauthenticated. When the 'openssl dgst' command is used with algorithms that only support one-shot signing (Ed25519, Ed448, ML-D... • https://packetstorm.news/files/id/215529 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 2CVE-2025-15467 – Stack buffer overflow in CMS (Auth)EnvelopedData parsing
https://notcve.org/view.php?id=CVE-2025-15467
27 Jan 2026 — Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacke... • https://packetstorm.news/files/id/214573 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2025-15468 – NULL dereference in SSL_CIPHER_find() function on unknown cipher ID
https://notcve.org/view.php?id=CVE-2025-15468
27 Jan 2026 — Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference ... • https://packetstorm.news/files/id/215529 • CWE-476: NULL Pointer Dereference •