{ "vulnerabilities": [ { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n", "epssDetails": { "percentile": "0.04935", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-09T18:15:42.459660Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n", "epssDetails": { "percentile": "0.04935", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-09T18:15:42.459660Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "sed@4.9-2", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n", "epssDetails": { "percentile": "0.04935", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-09T18:15:42.459660Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "dpkg@1.22.22", "tar@1.35+dfsg-3.1", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n", "epssDetails": { "percentile": "0.04935", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-09T18:15:42.459660Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n", "epssDetails": { "percentile": "0.04150", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T14:05:51.552428Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n", "epssDetails": { "percentile": "0.04150", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T14:05:51.552428Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-EXPAT-15158113", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.8.2-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.8.2-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-25210", "title": "https://security-tracker.debian.org/tracker/CVE-2026-25210" }, { "url": "https://github.com/libexpat/libexpat/pull/1075", "title": "https://github.com/libexpat/libexpat/pull/1075" }, { "url": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7", "title": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-03-11T01:17:33.097754Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "cvssV3BaseScore": 6.9, "modificationTime": "2026-01-30T21:11:35.448524Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-02-27T11:01:01.391245Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-03-11T01:17:33.097754Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.9, "cvssVersion": "3.1", "modificationTime": "2026-01-30T21:11:35.448524Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-02-27T11:01:01.391245Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.8.2-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-25210](https://security-tracker.debian.org/tracker/CVE-2026-25210)\n- [https://github.com/libexpat/libexpat/pull/1075](https://github.com/libexpat/libexpat/pull/1075)\n- [https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7](https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7)\n- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)\n", "epssDetails": { "percentile": "0.09345", "probability": "0.00196", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-25210" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-01-31T04:14:37.139101Z", "disclosureTime": "2026-01-30T07:16:15.570000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-01-31T04:14:37.145033Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-29T14:16:32.571730Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.8.2-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-16650098", "cpes": [], "title": "Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.8.2-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.8.2-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-45186", "title": "https://security-tracker.debian.org/tracker/CVE-2026-45186" }, { "url": "https://github.com/libexpat/libexpat/pull/1216", "title": "https://github.com/libexpat/libexpat/pull/1216" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/11/16", "title": "http://www.openwall.com/lists/oss-security/2026/05/11/16" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22715", "title": "https://access.redhat.com/errata/RHSA-2026:22715" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22721", "title": "https://access.redhat.com/errata/RHSA-2026:22721" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23230", "title": "https://access.redhat.com/errata/RHSA-2026:23230" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27201", "title": "https://access.redhat.com/errata/RHSA-2026:27201" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45186", "title": "https://access.redhat.com/security/cve/CVE-2026-45186" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-15T01:17:34.441251Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-20T05:26:34.072921Z" }, { "assigner": "SUSE", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 2.9, "modificationTime": "2026-08-22T22:00:04.406229Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-15T01:17:34.441251Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-20T05:26:34.072921Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "low", "baseScore": 2.9, "cvssVersion": "3.1", "modificationTime": "2026-08-22T22:00:04.406229Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.8.2-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-45186](https://security-tracker.debian.org/tracker/CVE-2026-45186)\n- [https://github.com/libexpat/libexpat/pull/1216](https://github.com/libexpat/libexpat/pull/1216)\n- [http://www.openwall.com/lists/oss-security/2026/05/11/16](http://www.openwall.com/lists/oss-security/2026/05/11/16)\n- [https://access.redhat.com/errata/RHSA-2026:22715](https://access.redhat.com/errata/RHSA-2026:22715)\n- [https://access.redhat.com/errata/RHSA-2026:22721](https://access.redhat.com/errata/RHSA-2026:22721)\n- [https://access.redhat.com/errata/RHSA-2026:23230](https://access.redhat.com/errata/RHSA-2026:23230)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:27201](https://access.redhat.com/errata/RHSA-2026:27201)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/security/cve/CVE-2026-45186](https://access.redhat.com/security/cve/CVE-2026-45186)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2468575](https://bugzilla.redhat.com/show_bug.cgi?id=2468575)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n", "epssDetails": { "percentile": "0.38010", "probability": "0.00460", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45186" ], "CWE": [ "CWE-407" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-05-14T03:14:57.908531Z", "disclosureTime": "2026-05-10T07:16:07.883000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-14T03:14:57.914104Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-26T14:03:50.932970Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.8.2-1~deb13u1" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344298", "cpes": [], "title": "Improper Validation of Specified Quantity in Input", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42013", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42013" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42013", "title": "https://access.redhat.com/security/cve/CVE-2026-42013" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-8", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T01:20:29.680083Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T05:26:35.954355Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-05-28T11:03:19.130070Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:29.680083Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:35.954355Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:19.130070Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42013](https://security-tracker.debian.org/tracker/CVE-2026-42013)\n- [https://access.redhat.com/security/cve/CVE-2026-42013](https://access.redhat.com/security/cve/CVE-2026-42013)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467448](https://bugzilla.redhat.com/show_bug.cgi?id=2467448)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n", "epssDetails": { "percentile": "0.33877", "probability": "0.00423", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42013" ], "CWE": [ "CWE-1284" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:21.942546Z", "disclosureTime": "2026-05-26T22:16:42.050000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:21.945511Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T01:29:35.925635Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344302", "cpes": [], "title": "Improper Handling of Length Parameter Inconsistency", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-33846", "title": "https://security-tracker.debian.org/tracker/CVE-2026-33846" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34372", "title": "https://access.redhat.com/errata/RHSA-2026:34372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56786", "title": "https://access.redhat.com/errata/RHSA-2026:56786" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56911", "title": "https://access.redhat.com/errata/RHSA-2026:56911" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57402", "title": "https://access.redhat.com/errata/RHSA-2026:57402" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33846", "title": "https://access.redhat.com/security/cve/CVE-2026-33846" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-04T13:18:50.685622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-04T14:11:05.322162Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-28T11:03:05.454188Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-04T13:18:50.685622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-04T14:11:05.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:05.454188Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-33846](https://security-tracker.debian.org/tracker/CVE-2026-33846)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34372](https://access.redhat.com/errata/RHSA-2026:34372)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56786](https://access.redhat.com/errata/RHSA-2026:56786)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:56911](https://access.redhat.com/errata/RHSA-2026:56911)\n- [https://access.redhat.com/errata/RHSA-2026:57402](https://access.redhat.com/errata/RHSA-2026:57402)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/security/cve/CVE-2026-33846](https://access.redhat.com/security/cve/CVE-2026-33846)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2450625](https://bugzilla.redhat.com/show_bug.cgi?id=2450625)\n", "epssDetails": { "percentile": "0.66024", "probability": "0.01263", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33846" ], "CWE": [ "CWE-130" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:29.516977Z", "disclosureTime": "2026-05-04T10:15:59.690000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:29.520339Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:29:58.063000Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344305", "cpes": [], "title": "Undefined Behavior for Input to API", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42009", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42009" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-2", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-2" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29794", "title": "https://access.redhat.com/errata/RHSA-2026:29794" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34372", "title": "https://access.redhat.com/errata/RHSA-2026:34372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34764", "title": "https://access.redhat.com/errata/RHSA-2026:34764" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34788", "title": "https://access.redhat.com/errata/RHSA-2026:34788" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56786", "title": "https://access.redhat.com/errata/RHSA-2026:56786" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56911", "title": "https://access.redhat.com/errata/RHSA-2026:56911" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42009", "title": "https://access.redhat.com/security/cve/CVE-2026-42009" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-19T01:29:28.559900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-19T02:45:22.528690Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-28T11:03:18.680808Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-19T01:29:28.559900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-19T02:45:22.528690Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:18.680808Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42009](https://security-tracker.debian.org/tracker/CVE-2026-42009)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:29794](https://access.redhat.com/errata/RHSA-2026:29794)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34372](https://access.redhat.com/errata/RHSA-2026:34372)\n- [https://access.redhat.com/errata/RHSA-2026:34764](https://access.redhat.com/errata/RHSA-2026:34764)\n- [https://access.redhat.com/errata/RHSA-2026:34788](https://access.redhat.com/errata/RHSA-2026:34788)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56786](https://access.redhat.com/errata/RHSA-2026:56786)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:56911](https://access.redhat.com/errata/RHSA-2026:56911)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/security/cve/CVE-2026-42009](https://access.redhat.com/security/cve/CVE-2026-42009)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467279](https://bugzilla.redhat.com/show_bug.cgi?id=2467279)\n", "epssDetails": { "percentile": "0.67625", "probability": "0.01335", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42009" ], "CWE": [ "CWE-475" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:34.801888Z", "disclosureTime": "2026-05-18T13:16:32.707000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:34.804862Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:30:25.176011Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344307", "cpes": [], "title": "Improper Certificate Validation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42012", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42012" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42012", "title": "https://access.redhat.com/security/cve/CVE-2026-42012" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-7", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-27T01:20:29.572738Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-27T05:26:44.782325Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:16:06.073944Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:29.572738Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:44.782325Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:16:06.073944Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42012](https://security-tracker.debian.org/tracker/CVE-2026-42012)\n- [https://access.redhat.com/security/cve/CVE-2026-42012](https://access.redhat.com/security/cve/CVE-2026-42012)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467441](https://bugzilla.redhat.com/show_bug.cgi?id=2467441)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n", "epssDetails": { "percentile": "0.27253", "probability": "0.00354", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42012" ], "CWE": [ "CWE-295" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:37.614791Z", "disclosureTime": "2026-05-26T22:16:41.913000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:37.617212Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-25T13:24:50.481073Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344314", "cpes": [], "title": "Integer Underflow", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-33845", "title": "https://security-tracker.debian.org/tracker/CVE-2026-33845" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34372", "title": "https://access.redhat.com/errata/RHSA-2026:34372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56786", "title": "https://access.redhat.com/errata/RHSA-2026:56786" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56911", "title": "https://access.redhat.com/errata/RHSA-2026:56911" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57402", "title": "https://access.redhat.com/errata/RHSA-2026:57402" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33845", "title": "https://access.redhat.com/security/cve/CVE-2026-33845" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-05-05T13:13:51.910844Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-03T06:31:47.350814Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-28T11:03:10.673322Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-05-05T13:13:51.910844Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-03T06:31:47.350814Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:10.673322Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-33845](https://security-tracker.debian.org/tracker/CVE-2026-33845)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34372](https://access.redhat.com/errata/RHSA-2026:34372)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56786](https://access.redhat.com/errata/RHSA-2026:56786)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:56911](https://access.redhat.com/errata/RHSA-2026:56911)\n- [https://access.redhat.com/errata/RHSA-2026:57402](https://access.redhat.com/errata/RHSA-2026:57402)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/security/cve/CVE-2026-33845](https://access.redhat.com/security/cve/CVE-2026-33845)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2450624](https://bugzilla.redhat.com/show_bug.cgi?id=2450624)\n", "epssDetails": { "percentile": "0.52158", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33845" ], "CWE": [ "CWE-191" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:47.385803Z", "disclosureTime": "2026-04-30T18:16:28.003000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:47.389097Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:30:33.661419Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344321", "cpes": [], "title": "Improper Handling of Case Sensitivity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-3833", "title": "https://security-tracker.debian.org/tracker/CVE-2026-3833" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3833", "title": "https://access.redhat.com/security/cve/CVE-2026-3833" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57402", "title": "https://access.redhat.com/errata/RHSA-2026:57402" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62549", "title": "https://access.redhat.com/errata/RHSA-2026:62549" }, { "url": "https://gitlab.com/gnutls/gnutls/-/issues/1803", "title": "https://gitlab.com/gnutls/gnutls/-/issues/1803" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-05-07T13:17:18.084368Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-05-03T06:31:44.374935Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-05-28T11:03:07.215839Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-05-07T13:17:18.084368Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-05-03T06:31:44.374935Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:07.215839Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-3833](https://security-tracker.debian.org/tracker/CVE-2026-3833)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/security/cve/CVE-2026-3833](https://access.redhat.com/security/cve/CVE-2026-3833)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2445763](https://bugzilla.redhat.com/show_bug.cgi?id=2445763)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57402](https://access.redhat.com/errata/RHSA-2026:57402)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:62549](https://access.redhat.com/errata/RHSA-2026:62549)\n- [https://gitlab.com/gnutls/gnutls/-/issues/1803](https://gitlab.com/gnutls/gnutls/-/issues/1803)\n", "epssDetails": { "percentile": "0.43477", "probability": "0.00565", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-3833" ], "CWE": [ "CWE-178" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:55.549982Z", "disclosureTime": "2026-04-30T18:16:30.577000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:55.553386Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T13:35:24.471171Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344330", "cpes": [], "title": "Improper Validation of Specified Quantity in Input", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-5260", "title": "https://security-tracker.debian.org/tracker/CVE-2026-5260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5260", "title": "https://access.redhat.com/security/cve/CVE-2026-5260" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-10", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-10" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T01:20:30.889352Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T05:26:47.000997Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-05-28T11:03:28.107931Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:30.889352Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:47.000997Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:28.107931Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-5260](https://security-tracker.debian.org/tracker/CVE-2026-5260)\n- [https://access.redhat.com/security/cve/CVE-2026-5260](https://access.redhat.com/security/cve/CVE-2026-5260)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467450](https://bugzilla.redhat.com/show_bug.cgi?id=2467450)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n", "epssDetails": { "percentile": "0.49520", "probability": "0.00727", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-5260" ], "CWE": [ "CWE-1284" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:25:05.831333Z", "disclosureTime": "2026-05-26T22:16:44.170000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:25:05.834502Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T01:29:37.091930Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344352", "cpes": [], "title": "Improper Certificate Validation", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42011", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42011" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42011", "title": "https://access.redhat.com/security/cve/CVE-2026-42011" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-6", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-05-08T01:24:22.687463Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-05-08T13:01:38.342523Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 4.8, "modificationTime": "2026-05-28T11:03:14.070348Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-05-08T01:24:22.687463Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-05-08T13:01:38.342523Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 4.8, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:14.070348Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42011](https://security-tracker.debian.org/tracker/CVE-2026-42011)\n- [https://access.redhat.com/security/cve/CVE-2026-42011](https://access.redhat.com/security/cve/CVE-2026-42011)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467437](https://bugzilla.redhat.com/show_bug.cgi?id=2467437)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n", "epssDetails": { "percentile": "0.37525", "probability": "0.00475", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42011" ], "CWE": [ "CWE-295" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:25:53.625227Z", "disclosureTime": "2026-05-07T15:16:09.760000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:25:53.627670Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T01:29:35.339524Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344357", "cpes": [], "title": "Improper Null Termination", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42010", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42010" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-4", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-4" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34764", "title": "https://access.redhat.com/errata/RHSA-2026:34764" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34788", "title": "https://access.redhat.com/errata/RHSA-2026:34788" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34790", "title": "https://access.redhat.com/errata/RHSA-2026:34790" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42010", "title": "https://access.redhat.com/security/cve/CVE-2026-42010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-05-14T01:14:25.281118Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-07T20:51:07.200810Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-28T11:03:11.486144Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-05-14T01:14:25.281118Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-07T20:51:07.200810Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:11.486144Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42010](https://security-tracker.debian.org/tracker/CVE-2026-42010)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34764](https://access.redhat.com/errata/RHSA-2026:34764)\n- [https://access.redhat.com/errata/RHSA-2026:34788](https://access.redhat.com/errata/RHSA-2026:34788)\n- [https://access.redhat.com/errata/RHSA-2026:34790](https://access.redhat.com/errata/RHSA-2026:34790)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/security/cve/CVE-2026-42010](https://access.redhat.com/security/cve/CVE-2026-42010)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467289](https://bugzilla.redhat.com/show_bug.cgi?id=2467289)\n", "epssDetails": { "percentile": "0.59992", "probability": "0.01050", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42010" ], "CWE": [ "CWE-170" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "gnutls28", "creationTime": "2026-05-02T16:25:59.347787Z", "disclosureTime": "2026-05-07T12:16:17.977000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:25:59.350754Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:30:15.305915Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-LIBCAP2-15960217", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1:2.75-10+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1:2.75-10+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-4878", "title": "https://security-tracker.debian.org/tracker/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/14", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/14" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/4", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/4" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/08/9", "title": "http://www.openwall.com/lists/oss-security/2026/04/08/9" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/5", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/5" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/6", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/6" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12423", "title": "https://access.redhat.com/errata/RHSA-2026:12423" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12441", "title": "https://access.redhat.com/errata/RHSA-2026:12441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13285", "title": "https://access.redhat.com/errata/RHSA-2026:13285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14162", "title": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14937", "title": "https://access.redhat.com/errata/RHSA-2026:14937" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19130", "title": "https://access.redhat.com/errata/RHSA-2026:19130" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19346", "title": "https://access.redhat.com/errata/RHSA-2026:19346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19456", "title": "https://access.redhat.com/errata/RHSA-2026:19456" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19458", "title": "https://access.redhat.com/errata/RHSA-2026:19458" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20595", "title": "https://access.redhat.com/errata/RHSA-2026:20595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21254", "title": "https://access.redhat.com/errata/RHSA-2026:21254" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21275", "title": "https://access.redhat.com/errata/RHSA-2026:21275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22634", "title": "https://access.redhat.com/errata/RHSA-2026:22634" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22957", "title": "https://access.redhat.com/errata/RHSA-2026:22957" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "title": "https://access.redhat.com/errata/RHSA-2026:23233" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "title": "https://access.redhat.com/errata/RHSA-2026:23245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24346", "title": "https://access.redhat.com/errata/RHSA-2026:24346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "title": "https://access.redhat.com/errata/RHSA-2026:25044" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25096", "title": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25181", "title": "https://access.redhat.com/errata/RHSA-2026:25181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26542", "title": "https://access.redhat.com/errata/RHSA-2026:26542" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27998", "title": "https://access.redhat.com/errata/RHSA-2026:27998" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "title": "https://access.redhat.com/errata/RHSA-2026:28887" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30078", "title": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30087", "title": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "title": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "title": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "title": "https://access.redhat.com/errata/RHSA-2026:34098" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7473", "title": "https://access.redhat.com/errata/RHSA-2026:7473" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4878", "title": "https://access.redhat.com/security/cve/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.7, "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.7, "cvssVersion": "3.1", "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libcap2` package and not the `libcap2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n## Remediation\nUpgrade `Debian:13` `libcap2` to version 1:2.75-10+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-4878](https://security-tracker.debian.org/tracker/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2447554](https://bugzilla.redhat.com/show_bug.cgi?id=2447554)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/14](http://www.openwall.com/lists/oss-security/2026/04/07/14)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/4](http://www.openwall.com/lists/oss-security/2026/04/07/4)\n- [http://www.openwall.com/lists/oss-security/2026/04/08/9](http://www.openwall.com/lists/oss-security/2026/04/08/9)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/5](http://www.openwall.com/lists/oss-security/2026/04/09/5)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/6](http://www.openwall.com/lists/oss-security/2026/04/09/6)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)\n- [https://access.redhat.com/errata/RHSA-2026:12423](https://access.redhat.com/errata/RHSA-2026:12423)\n- [https://access.redhat.com/errata/RHSA-2026:12441](https://access.redhat.com/errata/RHSA-2026:12441)\n- [https://access.redhat.com/errata/RHSA-2026:13285](https://access.redhat.com/errata/RHSA-2026:13285)\n- [https://access.redhat.com/errata/RHSA-2026:14162](https://access.redhat.com/errata/RHSA-2026:14162)\n- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)\n- [https://access.redhat.com/errata/RHSA-2026:19130](https://access.redhat.com/errata/RHSA-2026:19130)\n- [https://access.redhat.com/errata/RHSA-2026:19346](https://access.redhat.com/errata/RHSA-2026:19346)\n- [https://access.redhat.com/errata/RHSA-2026:19456](https://access.redhat.com/errata/RHSA-2026:19456)\n- [https://access.redhat.com/errata/RHSA-2026:19458](https://access.redhat.com/errata/RHSA-2026:19458)\n- [https://access.redhat.com/errata/RHSA-2026:20595](https://access.redhat.com/errata/RHSA-2026:20595)\n- [https://access.redhat.com/errata/RHSA-2026:21254](https://access.redhat.com/errata/RHSA-2026:21254)\n- [https://access.redhat.com/errata/RHSA-2026:21275](https://access.redhat.com/errata/RHSA-2026:21275)\n- [https://access.redhat.com/errata/RHSA-2026:22634](https://access.redhat.com/errata/RHSA-2026:22634)\n- [https://access.redhat.com/errata/RHSA-2026:22957](https://access.redhat.com/errata/RHSA-2026:22957)\n- [https://access.redhat.com/errata/RHSA-2026:23233](https://access.redhat.com/errata/RHSA-2026:23233)\n- [https://access.redhat.com/errata/RHSA-2026:23245](https://access.redhat.com/errata/RHSA-2026:23245)\n- [https://access.redhat.com/errata/RHSA-2026:24346](https://access.redhat.com/errata/RHSA-2026:24346)\n- [https://access.redhat.com/errata/RHSA-2026:25044](https://access.redhat.com/errata/RHSA-2026:25044)\n- [https://access.redhat.com/errata/RHSA-2026:25096](https://access.redhat.com/errata/RHSA-2026:25096)\n- [https://access.redhat.com/errata/RHSA-2026:25181](https://access.redhat.com/errata/RHSA-2026:25181)\n- [https://access.redhat.com/errata/RHSA-2026:26542](https://access.redhat.com/errata/RHSA-2026:26542)\n- [https://access.redhat.com/errata/RHSA-2026:27998](https://access.redhat.com/errata/RHSA-2026:27998)\n- [https://access.redhat.com/errata/RHSA-2026:28887](https://access.redhat.com/errata/RHSA-2026:28887)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30078](https://access.redhat.com/errata/RHSA-2026:30078)\n- [https://access.redhat.com/errata/RHSA-2026:30087](https://access.redhat.com/errata/RHSA-2026:30087)\n- [https://access.redhat.com/errata/RHSA-2026:30088](https://access.redhat.com/errata/RHSA-2026:30088)\n- [https://access.redhat.com/errata/RHSA-2026:30089](https://access.redhat.com/errata/RHSA-2026:30089)\n- [https://access.redhat.com/errata/RHSA-2026:34098](https://access.redhat.com/errata/RHSA-2026:34098)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:7473](https://access.redhat.com/errata/RHSA-2026:7473)\n- [https://access.redhat.com/security/cve/CVE-2026-4878](https://access.redhat.com/security/cve/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2451615](https://bugzilla.redhat.com/show_bug.cgi?id=2451615)\n", "epssDetails": { "percentile": "0.10773", "probability": "0.00206", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4878" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libcap2", "creationTime": "2026-04-10T02:48:53.969488Z", "disclosureTime": "2026-04-09T16:16:31.987000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T02:48:53.978462Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:29:55.005720Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "libcap2/libcap2@1:2.75-10+b8" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "libcap2/libcap2", "version": "1:2.75-10+b8", "nearestFixedInVersion": "1:2.75-10+deb13u1" }, { "id": "SNYK-DEBIAN13-LIBCAP2-15960217", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1:2.75-10+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1:2.75-10+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-4878", "title": "https://security-tracker.debian.org/tracker/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/14", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/14" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/4", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/4" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/08/9", "title": "http://www.openwall.com/lists/oss-security/2026/04/08/9" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/5", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/5" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/6", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/6" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12423", "title": "https://access.redhat.com/errata/RHSA-2026:12423" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12441", "title": "https://access.redhat.com/errata/RHSA-2026:12441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13285", "title": "https://access.redhat.com/errata/RHSA-2026:13285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14162", "title": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14937", "title": "https://access.redhat.com/errata/RHSA-2026:14937" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19130", "title": "https://access.redhat.com/errata/RHSA-2026:19130" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19346", "title": "https://access.redhat.com/errata/RHSA-2026:19346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19456", "title": "https://access.redhat.com/errata/RHSA-2026:19456" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19458", "title": "https://access.redhat.com/errata/RHSA-2026:19458" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20595", "title": "https://access.redhat.com/errata/RHSA-2026:20595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21254", "title": "https://access.redhat.com/errata/RHSA-2026:21254" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21275", "title": "https://access.redhat.com/errata/RHSA-2026:21275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22634", "title": "https://access.redhat.com/errata/RHSA-2026:22634" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22957", "title": "https://access.redhat.com/errata/RHSA-2026:22957" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "title": "https://access.redhat.com/errata/RHSA-2026:23233" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "title": "https://access.redhat.com/errata/RHSA-2026:23245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24346", "title": "https://access.redhat.com/errata/RHSA-2026:24346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "title": "https://access.redhat.com/errata/RHSA-2026:25044" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25096", "title": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25181", "title": "https://access.redhat.com/errata/RHSA-2026:25181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26542", "title": "https://access.redhat.com/errata/RHSA-2026:26542" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27998", "title": "https://access.redhat.com/errata/RHSA-2026:27998" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "title": "https://access.redhat.com/errata/RHSA-2026:28887" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30078", "title": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30087", "title": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "title": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "title": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "title": "https://access.redhat.com/errata/RHSA-2026:34098" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7473", "title": "https://access.redhat.com/errata/RHSA-2026:7473" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4878", "title": "https://access.redhat.com/security/cve/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.7, "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.7, "cvssVersion": "3.1", "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libcap2` package and not the `libcap2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n## Remediation\nUpgrade `Debian:13` `libcap2` to version 1:2.75-10+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-4878](https://security-tracker.debian.org/tracker/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2447554](https://bugzilla.redhat.com/show_bug.cgi?id=2447554)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/14](http://www.openwall.com/lists/oss-security/2026/04/07/14)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/4](http://www.openwall.com/lists/oss-security/2026/04/07/4)\n- [http://www.openwall.com/lists/oss-security/2026/04/08/9](http://www.openwall.com/lists/oss-security/2026/04/08/9)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/5](http://www.openwall.com/lists/oss-security/2026/04/09/5)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/6](http://www.openwall.com/lists/oss-security/2026/04/09/6)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)\n- [https://access.redhat.com/errata/RHSA-2026:12423](https://access.redhat.com/errata/RHSA-2026:12423)\n- [https://access.redhat.com/errata/RHSA-2026:12441](https://access.redhat.com/errata/RHSA-2026:12441)\n- [https://access.redhat.com/errata/RHSA-2026:13285](https://access.redhat.com/errata/RHSA-2026:13285)\n- [https://access.redhat.com/errata/RHSA-2026:14162](https://access.redhat.com/errata/RHSA-2026:14162)\n- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)\n- [https://access.redhat.com/errata/RHSA-2026:19130](https://access.redhat.com/errata/RHSA-2026:19130)\n- [https://access.redhat.com/errata/RHSA-2026:19346](https://access.redhat.com/errata/RHSA-2026:19346)\n- [https://access.redhat.com/errata/RHSA-2026:19456](https://access.redhat.com/errata/RHSA-2026:19456)\n- [https://access.redhat.com/errata/RHSA-2026:19458](https://access.redhat.com/errata/RHSA-2026:19458)\n- [https://access.redhat.com/errata/RHSA-2026:20595](https://access.redhat.com/errata/RHSA-2026:20595)\n- [https://access.redhat.com/errata/RHSA-2026:21254](https://access.redhat.com/errata/RHSA-2026:21254)\n- [https://access.redhat.com/errata/RHSA-2026:21275](https://access.redhat.com/errata/RHSA-2026:21275)\n- [https://access.redhat.com/errata/RHSA-2026:22634](https://access.redhat.com/errata/RHSA-2026:22634)\n- [https://access.redhat.com/errata/RHSA-2026:22957](https://access.redhat.com/errata/RHSA-2026:22957)\n- [https://access.redhat.com/errata/RHSA-2026:23233](https://access.redhat.com/errata/RHSA-2026:23233)\n- [https://access.redhat.com/errata/RHSA-2026:23245](https://access.redhat.com/errata/RHSA-2026:23245)\n- [https://access.redhat.com/errata/RHSA-2026:24346](https://access.redhat.com/errata/RHSA-2026:24346)\n- [https://access.redhat.com/errata/RHSA-2026:25044](https://access.redhat.com/errata/RHSA-2026:25044)\n- [https://access.redhat.com/errata/RHSA-2026:25096](https://access.redhat.com/errata/RHSA-2026:25096)\n- [https://access.redhat.com/errata/RHSA-2026:25181](https://access.redhat.com/errata/RHSA-2026:25181)\n- [https://access.redhat.com/errata/RHSA-2026:26542](https://access.redhat.com/errata/RHSA-2026:26542)\n- [https://access.redhat.com/errata/RHSA-2026:27998](https://access.redhat.com/errata/RHSA-2026:27998)\n- [https://access.redhat.com/errata/RHSA-2026:28887](https://access.redhat.com/errata/RHSA-2026:28887)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30078](https://access.redhat.com/errata/RHSA-2026:30078)\n- [https://access.redhat.com/errata/RHSA-2026:30087](https://access.redhat.com/errata/RHSA-2026:30087)\n- [https://access.redhat.com/errata/RHSA-2026:30088](https://access.redhat.com/errata/RHSA-2026:30088)\n- [https://access.redhat.com/errata/RHSA-2026:30089](https://access.redhat.com/errata/RHSA-2026:30089)\n- [https://access.redhat.com/errata/RHSA-2026:34098](https://access.redhat.com/errata/RHSA-2026:34098)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:7473](https://access.redhat.com/errata/RHSA-2026:7473)\n- [https://access.redhat.com/security/cve/CVE-2026-4878](https://access.redhat.com/security/cve/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2451615](https://bugzilla.redhat.com/show_bug.cgi?id=2451615)\n", "epssDetails": { "percentile": "0.10773", "probability": "0.00206", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4878" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libcap2", "creationTime": "2026-04-10T02:48:53.969488Z", "disclosureTime": "2026-04-09T16:16:31.987000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T02:48:53.978462Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:29:55.005720Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "systemd/libudev1@257.9-1~deb13u1", "libcap2/libcap2@1:2.75-10+b8" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "libcap2/libcap2", "version": "1:2.75-10+b8", "nearestFixedInVersion": "1:2.75-10+deb13u1" }, { "id": "SNYK-DEBIAN13-LIBCAP2-15960217", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1:2.75-10+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1:2.75-10+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-4878", "title": "https://security-tracker.debian.org/tracker/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/14", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/14" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/4", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/4" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/08/9", "title": "http://www.openwall.com/lists/oss-security/2026/04/08/9" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/5", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/5" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/6", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/6" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12423", "title": "https://access.redhat.com/errata/RHSA-2026:12423" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12441", "title": "https://access.redhat.com/errata/RHSA-2026:12441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13285", "title": "https://access.redhat.com/errata/RHSA-2026:13285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14162", "title": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14937", "title": "https://access.redhat.com/errata/RHSA-2026:14937" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19130", "title": "https://access.redhat.com/errata/RHSA-2026:19130" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19346", "title": "https://access.redhat.com/errata/RHSA-2026:19346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19456", "title": "https://access.redhat.com/errata/RHSA-2026:19456" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19458", "title": "https://access.redhat.com/errata/RHSA-2026:19458" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20595", "title": "https://access.redhat.com/errata/RHSA-2026:20595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21254", "title": "https://access.redhat.com/errata/RHSA-2026:21254" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21275", "title": "https://access.redhat.com/errata/RHSA-2026:21275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22634", "title": "https://access.redhat.com/errata/RHSA-2026:22634" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22957", "title": "https://access.redhat.com/errata/RHSA-2026:22957" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "title": "https://access.redhat.com/errata/RHSA-2026:23233" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "title": "https://access.redhat.com/errata/RHSA-2026:23245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24346", "title": "https://access.redhat.com/errata/RHSA-2026:24346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "title": "https://access.redhat.com/errata/RHSA-2026:25044" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25096", "title": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25181", "title": "https://access.redhat.com/errata/RHSA-2026:25181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26542", "title": "https://access.redhat.com/errata/RHSA-2026:26542" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27998", "title": "https://access.redhat.com/errata/RHSA-2026:27998" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "title": "https://access.redhat.com/errata/RHSA-2026:28887" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30078", "title": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30087", "title": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "title": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "title": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "title": "https://access.redhat.com/errata/RHSA-2026:34098" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7473", "title": "https://access.redhat.com/errata/RHSA-2026:7473" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4878", "title": "https://access.redhat.com/security/cve/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.7, "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.7, "cvssVersion": "3.1", "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libcap2` package and not the `libcap2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n## Remediation\nUpgrade `Debian:13` `libcap2` to version 1:2.75-10+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-4878](https://security-tracker.debian.org/tracker/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2447554](https://bugzilla.redhat.com/show_bug.cgi?id=2447554)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/14](http://www.openwall.com/lists/oss-security/2026/04/07/14)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/4](http://www.openwall.com/lists/oss-security/2026/04/07/4)\n- [http://www.openwall.com/lists/oss-security/2026/04/08/9](http://www.openwall.com/lists/oss-security/2026/04/08/9)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/5](http://www.openwall.com/lists/oss-security/2026/04/09/5)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/6](http://www.openwall.com/lists/oss-security/2026/04/09/6)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)\n- [https://access.redhat.com/errata/RHSA-2026:12423](https://access.redhat.com/errata/RHSA-2026:12423)\n- [https://access.redhat.com/errata/RHSA-2026:12441](https://access.redhat.com/errata/RHSA-2026:12441)\n- [https://access.redhat.com/errata/RHSA-2026:13285](https://access.redhat.com/errata/RHSA-2026:13285)\n- [https://access.redhat.com/errata/RHSA-2026:14162](https://access.redhat.com/errata/RHSA-2026:14162)\n- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)\n- [https://access.redhat.com/errata/RHSA-2026:19130](https://access.redhat.com/errata/RHSA-2026:19130)\n- [https://access.redhat.com/errata/RHSA-2026:19346](https://access.redhat.com/errata/RHSA-2026:19346)\n- [https://access.redhat.com/errata/RHSA-2026:19456](https://access.redhat.com/errata/RHSA-2026:19456)\n- [https://access.redhat.com/errata/RHSA-2026:19458](https://access.redhat.com/errata/RHSA-2026:19458)\n- [https://access.redhat.com/errata/RHSA-2026:20595](https://access.redhat.com/errata/RHSA-2026:20595)\n- [https://access.redhat.com/errata/RHSA-2026:21254](https://access.redhat.com/errata/RHSA-2026:21254)\n- [https://access.redhat.com/errata/RHSA-2026:21275](https://access.redhat.com/errata/RHSA-2026:21275)\n- [https://access.redhat.com/errata/RHSA-2026:22634](https://access.redhat.com/errata/RHSA-2026:22634)\n- [https://access.redhat.com/errata/RHSA-2026:22957](https://access.redhat.com/errata/RHSA-2026:22957)\n- [https://access.redhat.com/errata/RHSA-2026:23233](https://access.redhat.com/errata/RHSA-2026:23233)\n- [https://access.redhat.com/errata/RHSA-2026:23245](https://access.redhat.com/errata/RHSA-2026:23245)\n- [https://access.redhat.com/errata/RHSA-2026:24346](https://access.redhat.com/errata/RHSA-2026:24346)\n- [https://access.redhat.com/errata/RHSA-2026:25044](https://access.redhat.com/errata/RHSA-2026:25044)\n- [https://access.redhat.com/errata/RHSA-2026:25096](https://access.redhat.com/errata/RHSA-2026:25096)\n- [https://access.redhat.com/errata/RHSA-2026:25181](https://access.redhat.com/errata/RHSA-2026:25181)\n- [https://access.redhat.com/errata/RHSA-2026:26542](https://access.redhat.com/errata/RHSA-2026:26542)\n- [https://access.redhat.com/errata/RHSA-2026:27998](https://access.redhat.com/errata/RHSA-2026:27998)\n- [https://access.redhat.com/errata/RHSA-2026:28887](https://access.redhat.com/errata/RHSA-2026:28887)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30078](https://access.redhat.com/errata/RHSA-2026:30078)\n- [https://access.redhat.com/errata/RHSA-2026:30087](https://access.redhat.com/errata/RHSA-2026:30087)\n- [https://access.redhat.com/errata/RHSA-2026:30088](https://access.redhat.com/errata/RHSA-2026:30088)\n- [https://access.redhat.com/errata/RHSA-2026:30089](https://access.redhat.com/errata/RHSA-2026:30089)\n- [https://access.redhat.com/errata/RHSA-2026:34098](https://access.redhat.com/errata/RHSA-2026:34098)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:7473](https://access.redhat.com/errata/RHSA-2026:7473)\n- [https://access.redhat.com/security/cve/CVE-2026-4878](https://access.redhat.com/security/cve/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2451615](https://bugzilla.redhat.com/show_bug.cgi?id=2451615)\n", "epssDetails": { "percentile": "0.10773", "probability": "0.00206", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4878" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libcap2", "creationTime": "2026-04-10T02:48:53.969488Z", "disclosureTime": "2026-04-09T16:16:31.987000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T02:48:53.978462Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-05T01:29:55.005720Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "pam/libpam-modules@1.7.0-5", "systemd/libsystemd0@257.9-1~deb13u1", "libcap2/libcap2@1:2.75-10+b8" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "libcap2/libcap2", "version": "1:2.75-10+b8", "nearestFixedInVersion": "1:2.75-10+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223359", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-49261", "title": "https://security-tracker.debian.org/tracker/CVE-2026-49261" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw" }, { "url": "https://jira.mariadb.org/browse/MDEV-39721", "title": "https://jira.mariadb.org/browse/MDEV-39721" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49261", "title": "https://access.redhat.com/security/cve/CVE-2026-49261" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52848", "title": "https://access.redhat.com/errata/RHSA-2026:52848" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54142", "title": "https://access.redhat.com/errata/RHSA-2026:54142" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "assigner": "SUSE", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-49261](https://security-tracker.debian.org/tracker/CVE-2026-49261)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw](https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw)\n- [https://jira.mariadb.org/browse/MDEV-39721](https://jira.mariadb.org/browse/MDEV-39721)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-49261](https://access.redhat.com/security/cve/CVE-2026-49261)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2487957](https://bugzilla.redhat.com/show_bug.cgi?id=2487957)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json)\n- [https://access.redhat.com/errata/RHSA-2026:52848](https://access.redhat.com/errata/RHSA-2026:52848)\n- [https://access.redhat.com/errata/RHSA-2026:54142](https://access.redhat.com/errata/RHSA-2026:54142)\n", "epssDetails": { "percentile": "0.73122", "probability": "0.01582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-49261" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:48:14.735286Z", "disclosureTime": "2026-06-11T18:16:26.553000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:48:14.741565Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-12T13:23:05.606117Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223368", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48165", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48165" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv" }, { "url": "https://jira.mariadb.org/browse/MDEV-39676", "title": "https://jira.mariadb.org/browse/MDEV-39676" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48165", "title": "https://access.redhat.com/security/cve/CVE-2026-48165" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48165](https://security-tracker.debian.org/tracker/CVE-2026-48165)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv](https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv)\n- [https://jira.mariadb.org/browse/MDEV-39676](https://jira.mariadb.org/browse/MDEV-39676)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48165](https://access.redhat.com/security/cve/CVE-2026-48165)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488458](https://bugzilla.redhat.com/show_bug.cgi?id=2488458)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json)\n", "epssDetails": { "percentile": "0.71848", "probability": "0.01506", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48165" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:05.767786Z", "disclosureTime": "2026-06-12T18:16:35.177000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:05.770362Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-04T14:05:07.620732Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223377", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48163", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48163" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r" }, { "url": "https://jira.mariadb.org/browse/MDEV-39648", "title": "https://jira.mariadb.org/browse/MDEV-39648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48163", "title": "https://access.redhat.com/security/cve/CVE-2026-48163" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48163](https://security-tracker.debian.org/tracker/CVE-2026-48163)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r](https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r)\n- [https://jira.mariadb.org/browse/MDEV-39648](https://jira.mariadb.org/browse/MDEV-39648)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48163](https://access.redhat.com/security/cve/CVE-2026-48163)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488454](https://bugzilla.redhat.com/show_bug.cgi?id=2488454)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json)\n", "epssDetails": { "percentile": "0.56679", "probability": "0.00914", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48163" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:19.042586Z", "disclosureTime": "2026-06-12T18:16:35.037000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:19.045500Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-04T14:05:07.106384Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223387", "cpes": [], "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44171", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44171" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9" }, { "url": "https://jira.mariadb.org/browse/MDEV-39408", "title": "https://jira.mariadb.org/browse/MDEV-39408" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.3, "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44171](https://security-tracker.debian.org/tracker/CVE-2026-44171)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9](https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9)\n- [https://jira.mariadb.org/browse/MDEV-39408](https://jira.mariadb.org/browse/MDEV-39408)\n", "epssDetails": { "percentile": "0.07159", "probability": "0.00175", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44171" ], "CWE": [ "CWE-22" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:40.071665Z", "disclosureTime": "2026-06-12T18:16:33.983000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:40.074312Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:06:33.028301Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223389", "cpes": [], "title": "SQL Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44172", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44172" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm" }, { "url": "https://jira.mariadb.org/browse/CONC-819", "title": "https://jira.mariadb.org/browse/CONC-819" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30135", "title": "https://access.redhat.com/errata/RHSA-2026:30135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43505", "title": "https://access.redhat.com/errata/RHSA-2026:43505" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-44172", "title": "https://access.redhat.com/security/cve/CVE-2026-44172" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47772", "title": "https://access.redhat.com/errata/RHSA-2026:47772" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44172](https://security-tracker.debian.org/tracker/CVE-2026-44172)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm](https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm)\n- [https://jira.mariadb.org/browse/CONC-819](https://jira.mariadb.org/browse/CONC-819)\n- [https://access.redhat.com/errata/RHSA-2026:30135](https://access.redhat.com/errata/RHSA-2026:30135)\n- [https://access.redhat.com/errata/RHSA-2026:43505](https://access.redhat.com/errata/RHSA-2026:43505)\n- [https://access.redhat.com/security/cve/CVE-2026-44172](https://access.redhat.com/security/cve/CVE-2026-44172)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488459](https://bugzilla.redhat.com/show_bug.cgi?id=2488459)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json)\n- [https://access.redhat.com/errata/RHSA-2026:47772](https://access.redhat.com/errata/RHSA-2026:47772)\n", "epssDetails": { "percentile": "0.44901", "probability": "0.00591", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44172" ], "CWE": [ "CWE-89" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:44.036819Z", "disclosureTime": "2026-06-12T18:16:34.123000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:44.039769Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-31T14:05:59.383610Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223359", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-49261", "title": "https://security-tracker.debian.org/tracker/CVE-2026-49261" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw" }, { "url": "https://jira.mariadb.org/browse/MDEV-39721", "title": "https://jira.mariadb.org/browse/MDEV-39721" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49261", "title": "https://access.redhat.com/security/cve/CVE-2026-49261" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52848", "title": "https://access.redhat.com/errata/RHSA-2026:52848" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54142", "title": "https://access.redhat.com/errata/RHSA-2026:54142" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "assigner": "SUSE", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-49261](https://security-tracker.debian.org/tracker/CVE-2026-49261)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw](https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw)\n- [https://jira.mariadb.org/browse/MDEV-39721](https://jira.mariadb.org/browse/MDEV-39721)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-49261](https://access.redhat.com/security/cve/CVE-2026-49261)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2487957](https://bugzilla.redhat.com/show_bug.cgi?id=2487957)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json)\n- [https://access.redhat.com/errata/RHSA-2026:52848](https://access.redhat.com/errata/RHSA-2026:52848)\n- [https://access.redhat.com/errata/RHSA-2026:54142](https://access.redhat.com/errata/RHSA-2026:54142)\n", "epssDetails": { "percentile": "0.73122", "probability": "0.01582", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-49261" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:48:14.735286Z", "disclosureTime": "2026-06-11T18:16:26.553000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:48:14.741565Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-12T13:23:05.606117Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223368", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48165", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48165" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv" }, { "url": "https://jira.mariadb.org/browse/MDEV-39676", "title": "https://jira.mariadb.org/browse/MDEV-39676" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48165", "title": "https://access.redhat.com/security/cve/CVE-2026-48165" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48165](https://security-tracker.debian.org/tracker/CVE-2026-48165)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv](https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv)\n- [https://jira.mariadb.org/browse/MDEV-39676](https://jira.mariadb.org/browse/MDEV-39676)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48165](https://access.redhat.com/security/cve/CVE-2026-48165)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488458](https://bugzilla.redhat.com/show_bug.cgi?id=2488458)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json)\n", "epssDetails": { "percentile": "0.71848", "probability": "0.01506", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48165" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:05.767786Z", "disclosureTime": "2026-06-12T18:16:35.177000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:05.770362Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-04T14:05:07.620732Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223377", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48163", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48163" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r" }, { "url": "https://jira.mariadb.org/browse/MDEV-39648", "title": "https://jira.mariadb.org/browse/MDEV-39648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48163", "title": "https://access.redhat.com/security/cve/CVE-2026-48163" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48163](https://security-tracker.debian.org/tracker/CVE-2026-48163)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r](https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r)\n- [https://jira.mariadb.org/browse/MDEV-39648](https://jira.mariadb.org/browse/MDEV-39648)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48163](https://access.redhat.com/security/cve/CVE-2026-48163)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488454](https://bugzilla.redhat.com/show_bug.cgi?id=2488454)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json)\n", "epssDetails": { "percentile": "0.56679", "probability": "0.00914", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48163" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:19.042586Z", "disclosureTime": "2026-06-12T18:16:35.037000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:19.045500Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-04T14:05:07.106384Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223387", "cpes": [], "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44171", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44171" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9" }, { "url": "https://jira.mariadb.org/browse/MDEV-39408", "title": "https://jira.mariadb.org/browse/MDEV-39408" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.3, "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44171](https://security-tracker.debian.org/tracker/CVE-2026-44171)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9](https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9)\n- [https://jira.mariadb.org/browse/MDEV-39408](https://jira.mariadb.org/browse/MDEV-39408)\n", "epssDetails": { "percentile": "0.07159", "probability": "0.00175", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44171" ], "CWE": [ "CWE-22" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:40.071665Z", "disclosureTime": "2026-06-12T18:16:33.983000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:40.074312Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:06:33.028301Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223389", "cpes": [], "title": "SQL Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44172", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44172" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm" }, { "url": "https://jira.mariadb.org/browse/CONC-819", "title": "https://jira.mariadb.org/browse/CONC-819" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30135", "title": "https://access.redhat.com/errata/RHSA-2026:30135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43505", "title": "https://access.redhat.com/errata/RHSA-2026:43505" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-44172", "title": "https://access.redhat.com/security/cve/CVE-2026-44172" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47772", "title": "https://access.redhat.com/errata/RHSA-2026:47772" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44172](https://security-tracker.debian.org/tracker/CVE-2026-44172)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm](https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm)\n- [https://jira.mariadb.org/browse/CONC-819](https://jira.mariadb.org/browse/CONC-819)\n- [https://access.redhat.com/errata/RHSA-2026:30135](https://access.redhat.com/errata/RHSA-2026:30135)\n- [https://access.redhat.com/errata/RHSA-2026:43505](https://access.redhat.com/errata/RHSA-2026:43505)\n- [https://access.redhat.com/security/cve/CVE-2026-44172](https://access.redhat.com/security/cve/CVE-2026-44172)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488459](https://bugzilla.redhat.com/show_bug.cgi?id=2488459)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json)\n- [https://access.redhat.com/errata/RHSA-2026:47772](https://access.redhat.com/errata/RHSA-2026:47772)\n", "epssDetails": { "percentile": "0.44901", "probability": "0.00591", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44172" ], "CWE": [ "CWE-89" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:44.036819Z", "disclosureTime": "2026-06-12T18:16:34.123000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:44.039769Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-31T14:05:59.383610Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.15604", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:04:38.595776Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.791509Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.49234", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.154618Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.53918", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:48.855673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.56424", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T14:04:49.575709Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-POSTGRESQL17-16748490", "cpes": [], "title": "CVE-2026-6638", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<17.10-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "17.10-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-6638", "title": "https://security-tracker.debian.org/tracker/CVE-2026-6638" }, { "url": "https://www.postgresql.org/support/security/CVE-2026-6638/", "title": "https://www.postgresql.org/support/security/CVE-2026-6638/" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.8, "modificationTime": "2026-05-19T01:29:30.418642Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 3.7, "modificationTime": "2026-07-15T05:27:46.820340Z" }, { "assigner": "SUSE", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 3.7, "modificationTime": "2026-05-19T11:05:18.140263Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.8, "cvssVersion": "3.1", "modificationTime": "2026-05-19T01:29:30.418642Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-07-15T05:27:46.820340Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "assigner": "SUSE", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-05-19T11:05:18.140263Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `postgresql-17` package and not the `postgresql-17` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.\n## Remediation\nUpgrade `Debian:13` `postgresql-17` to version 17.10-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-6638](https://security-tracker.debian.org/tracker/CVE-2026-6638)\n- [https://www.postgresql.org/support/security/CVE-2026-6638/](https://www.postgresql.org/support/security/CVE-2026-6638/)\n", "epssDetails": { "percentile": "0.07708", "probability": "0.00180", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-6638" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "postgresql-17", "creationTime": "2026-05-18T13:35:03.030753Z", "disclosureTime": "2026-05-14T14:16:25.937000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-18T13:35:03.033850Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-05T15:26:05.316340Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "postgresql-17/libpq5", "version": "17.9-0+deb13u1", "nearestFixedInVersion": "17.10-0+deb13u1" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779408", "cpes": [], "title": "CVE-2026-42960", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 10, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42960", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42960" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "cvssV3BaseScore": 10, "modificationTime": "2026-05-21T01:25:21.659062Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-05-27T05:26:34.014452Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-06-06T20:10:57.331482Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 10, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.659062Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:34.014452Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:57.331482Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42960](https://security-tracker.debian.org/tracker/CVE-2026-42960)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt)\n", "epssDetails": { "percentile": "0.15938", "probability": "0.00249", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42960" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-05-20T16:49:23.200531Z", "disclosureTime": "2026-05-20T10:16:28.037000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:49:23.206095Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-15T15:56:34.678578Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779411", "cpes": [], "title": "CVE-2026-33278", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-33278", "title": "https://security-tracker.debian.org/tracker/CVE-2026-33278" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19752", "title": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23231", "title": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24369", "title": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33278", "title": "https://access.redhat.com/security/cve/CVE-2026-33278" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-05-21T01:25:22.210241Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-05-20T14:02:19.835259Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 8.6, "modificationTime": "2026-06-06T20:10:50.243871Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:22.210241Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-05-20T14:02:19.835259Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:50.243871Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-33278](https://security-tracker.debian.org/tracker/CVE-2026-33278)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt)\n- [https://access.redhat.com/errata/RHSA-2026:19752](https://access.redhat.com/errata/RHSA-2026:19752)\n- [https://access.redhat.com/errata/RHSA-2026:23231](https://access.redhat.com/errata/RHSA-2026:23231)\n- [https://access.redhat.com/errata/RHSA-2026:24369](https://access.redhat.com/errata/RHSA-2026:24369)\n- [https://access.redhat.com/security/cve/CVE-2026-33278](https://access.redhat.com/security/cve/CVE-2026-33278)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2479808](https://bugzilla.redhat.com/show_bug.cgi?id=2479808)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json)\n", "epssDetails": { "percentile": "0.66226", "probability": "0.01272", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33278" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-05-20T16:50:14.317236Z", "disclosureTime": "2026-05-20T10:16:26.530000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:50:14.320012Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T13:27:57.198099Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779419", "cpes": [], "title": "CVE-2026-42944", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42944", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42944" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19752", "title": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23231", "title": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24365", "title": "https://access.redhat.com/errata/RHSA-2026:24365" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24369", "title": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42944", "title": "https://access.redhat.com/security/cve/CVE-2026-42944" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479774", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2479774" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-21T01:25:21.585601Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-20T14:03:25.229700Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-06T20:10:55.640752Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.585601Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-20T14:03:25.229700Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:55.640752Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42944](https://security-tracker.debian.org/tracker/CVE-2026-42944)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt)\n- [https://access.redhat.com/errata/RHSA-2026:19752](https://access.redhat.com/errata/RHSA-2026:19752)\n- [https://access.redhat.com/errata/RHSA-2026:23231](https://access.redhat.com/errata/RHSA-2026:23231)\n- [https://access.redhat.com/errata/RHSA-2026:24365](https://access.redhat.com/errata/RHSA-2026:24365)\n- [https://access.redhat.com/errata/RHSA-2026:24369](https://access.redhat.com/errata/RHSA-2026:24369)\n- [https://access.redhat.com/security/cve/CVE-2026-42944](https://access.redhat.com/security/cve/CVE-2026-42944)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2479774](https://bugzilla.redhat.com/show_bug.cgi?id=2479774)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json)\n", "epssDetails": { "percentile": "0.53291", "probability": "0.00842", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42944" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:50:25.135124Z", "disclosureTime": "2026-05-20T10:16:27.760000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:50:25.137925Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T13:27:55.867585Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779439", "cpes": [], "title": "CVE-2026-42959", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42959", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42959" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19752", "title": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23231", "title": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24365", "title": "https://access.redhat.com/errata/RHSA-2026:24365" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24369", "title": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42959", "title": "https://access.redhat.com/security/cve/CVE-2026-42959" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479806", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2479806" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-21T01:25:21.729814Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-20T14:03:32.866594Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-06T20:10:59.198852Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.729814Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-20T14:03:32.866594Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:59.198852Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42959](https://security-tracker.debian.org/tracker/CVE-2026-42959)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt)\n- [https://access.redhat.com/errata/RHSA-2026:19752](https://access.redhat.com/errata/RHSA-2026:19752)\n- [https://access.redhat.com/errata/RHSA-2026:23231](https://access.redhat.com/errata/RHSA-2026:23231)\n- [https://access.redhat.com/errata/RHSA-2026:24365](https://access.redhat.com/errata/RHSA-2026:24365)\n- [https://access.redhat.com/errata/RHSA-2026:24369](https://access.redhat.com/errata/RHSA-2026:24369)\n- [https://access.redhat.com/security/cve/CVE-2026-42959](https://access.redhat.com/security/cve/CVE-2026-42959)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2479806](https://bugzilla.redhat.com/show_bug.cgi?id=2479806)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json)\n", "epssDetails": { "percentile": "0.51262", "probability": "0.00779", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42959" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:51:38.274591Z", "disclosureTime": "2026-05-20T10:16:27.903000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:51:38.278669Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T13:27:57.201012Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779440", "cpes": [], "title": "CVE-2026-41292", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-41292", "title": "https://security-tracker.debian.org/tracker/CVE-2026-41292" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24013", "title": "https://access.redhat.com/errata/RHSA-2026:24013" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-41292", "title": "https://access.redhat.com/security/cve/CVE-2026-41292" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480125", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2480125" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36320", "title": "https://access.redhat.com/errata/RHSA-2026:36320" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36777", "title": "https://access.redhat.com/errata/RHSA-2026:36777" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37282", "title": "https://access.redhat.com/errata/RHSA-2026:37282" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-21T01:25:21.897076Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-24T05:50:13.101772Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-06-06T20:10:51.362862Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.897076Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:50:13.101772Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:51.362862Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-41292](https://security-tracker.debian.org/tracker/CVE-2026-41292)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt)\n- [https://access.redhat.com/errata/RHSA-2026:24013](https://access.redhat.com/errata/RHSA-2026:24013)\n- [https://access.redhat.com/security/cve/CVE-2026-41292](https://access.redhat.com/security/cve/CVE-2026-41292)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2480125](https://bugzilla.redhat.com/show_bug.cgi?id=2480125)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json)\n- [https://access.redhat.com/errata/RHSA-2026:36320](https://access.redhat.com/errata/RHSA-2026:36320)\n- [https://access.redhat.com/errata/RHSA-2026:36777](https://access.redhat.com/errata/RHSA-2026:36777)\n- [https://access.redhat.com/errata/RHSA-2026:37282](https://access.redhat.com/errata/RHSA-2026:37282)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n", "epssDetails": { "percentile": "0.51200", "probability": "0.00722", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-41292" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:51:38.303531Z", "disclosureTime": "2026-05-20T10:16:27.327000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:51:38.306725Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-20T14:05:47.180231Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779451", "cpes": [], "title": "CVE-2026-40622", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40622", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40622" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-27T01:20:04.603306Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-29T06:19:37.617042Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-06-06T20:10:51.125497Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:04.603306Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-29T06:19:37.617042Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:51.125497Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40622](https://security-tracker.debian.org/tracker/CVE-2026-40622)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt)\n", "epssDetails": { "percentile": "0.03414", "probability": "0.00136", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40622" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:52:27.441075Z", "disclosureTime": "2026-05-20T10:16:26.850000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:52:27.444056Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-29T06:19:37.981555Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-18228262", "cpes": [], "title": "CVE-2026-50252", "CVSSv3": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.3, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-50252", "title": "https://security-tracker.debian.org/tracker/CVE-2026-50252" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "cvssV3BaseScore": 9.3, "modificationTime": "2026-07-25T01:29:27.548619Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-08-19T05:38:37.624549Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-27T11:12:36.034907Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.3, "cvssVersion": "3.1", "modificationTime": "2026-07-25T01:29:27.548619Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:38:37.624549Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-27T11:12:36.034907Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.\n## Remediation\nThere is no fixed version for `Debian:13` `unbound`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-50252](https://security-tracker.debian.org/tracker/CVE-2026-50252)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt)\n", "epssDetails": { "percentile": "0.05709", "probability": "0.00163", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-50252" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-07-23T08:28:46.853168Z", "disclosureTime": "2026-07-22T14:17:20.627000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-07-23T08:28:46.857692Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-27T11:12:36.769736Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.36988", "probability": "0.00442", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T04:43:41.734714Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "dpkg@1.22.22", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.36988", "probability": "0.00442", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T04:43:41.734714Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.36988", "probability": "0.00442", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T04:43:41.734714Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.36988", "probability": "0.00442", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T04:43:41.734714Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.36988", "probability": "0.00442", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-04T04:43:41.734714Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" } ], "ok": false, "dependencyCount": 148, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Debian GNU/Linux 13 (trixie)" } }, "summary": "123 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 33, "projectName": "docker-image|docker.io/scopear/docker-xmpp-server", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-xmpp-server:c1a6e0c.develop.21/scopear/docker-xmpp-server", "applications": [ { "vulnerabilities": [], "ok": true, "dependencyCount": 1, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/share/nodejs/popper.js/package.json", "projectName": "popper.js", "displayTargetFile": "/usr/share/nodejs/popper.js/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-xmpp-server:c1a6e0c.develop.21" } ] }