Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade compat-openssl10Upgrade opensslUpgrade compat-openssl11Upgrade openssl-libsUpgrade openssl-develUpgrade openssl-perl | Jun 3, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade openssl | Apr 10, 2026 | Apr 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl11-debuginfoUpgrade openssl11-develUpgrade openssl-debuginfoUpgrade openssl11-staticUpgrade openssl-staticUpgrade openssl-snapsafe-staticUpgrade openssl-snapsafe-perlUpgrade openssl11Upgrade openssl-snapsafe-develUpgrade edk2-debuginfoUpgrade opensslUpgrade openssl11-libsUpgrade openssl-perlUpgrade edk2-aarch64Upgrade openssl-snapsafe-debuginfoUpgrade openssl-libsUpgrade openssl-develUpgrade edk2-toolsUpgrade openssl-snapsafeUpgrade openssl-snapsafe-libsUpgrade edk2-tools-docUpgrade edk2-ovmf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-snapsafe-libsUpgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-latestUpgrade opensslUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-libsUpgrade openssl-snapsafe-libs-debuginfo | Apr 14, 2026 | Apr 7, 2026 |
| Debian | — | Upgrade openssl | Apr 9, 2026 | Apr 9, 2026 |
| Freebsd | — | Upgrade openssl34Upgrade openssl36Upgrade openssl35Upgrade opensslUpgrade openssl111 | Apr 8, 2026 | Apr 7, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Apr 9, 2026 | Apr 7, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory47 | May 6, 2026 | May 4, 2026 |
| Oracle Missing Cpu Jul 2026 | — | Apply the July 2026 Critical Patch Update (CPU) for Oracle Database | Jul 22, 2026 | Apr 7, 2026 |
| Oracle_linux | — | Upgrade compat-openssl10 | Jun 4, 2026 | Apr 7, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Sep 7, 2026 | Apr 7, 2026 |
| Redhat_linux | — | Upgrade compat-openssl10Upgrade compat-openssl11-debuginfoUpgrade compat-openssl11-debugsourceUpgrade edk2-debugsourceUpgrade compat-openssl10-debuginfoNo solution existsUpgrade opensslUpgrade openssl-perlUpgrade openssl-staticUpgrade edk2-toolsUpgrade openssl-libsUpgrade edk2-aarch64Upgrade compat-openssl11Upgrade edk2-ovmfUpgrade openssl-debugsourceUpgrade compat-openssl10-debugsourceUpgrade openssl-debuginfoUpgrade edk2-tools-debuginfoUpgrade edk2-tools-docUpgrade openssl-develUpgrade openssl-libs-debuginfo | Jun 3, 2026 | Apr 7, 2026 |
| Rocky_linux | — | Upgrade compat-openssl10-debuginfoUpgrade compat-openssl11-debugsourceUpgrade compat-openssl11Upgrade openssl-libsUpgrade compat-openssl10Upgrade openssl-perlUpgrade openssl-develUpgrade openssl-debuginfoUpgrade opensslUpgrade compat-openssl11-debuginfoUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade compat-openssl10-debugsource | Jun 4, 2026 | Jun 2, 2026 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 10.0.8Upgrade Splunk Universal Forwarder to version 10.2.5Upgrade Splunk Universal Forwarder to version 9.4.13Upgrade Splunk Universal Forwarder to version 9.4.14Upgrade Splunk Universal Forwarder to version 10.4.2Upgrade Splunk Universal Forwarder to version 10.2.6Upgrade Splunk Universal Forwarder to version 10.0.9Upgrade Splunk Universal Forwarder to version 10.4.1 | Jul 30, 2026 | Apr 7, 2026 |
| Ubuntu | — | Upgrade libssl3Upgrade openssl (Ubuntu Pro)Upgrade libssl1.1 (Ubuntu Pro)Upgrade openssl1.0 (Ubuntu Pro)Upgrade opensslUpgrade libssl1.0.0 (Ubuntu Pro)Upgrade libssl3t64 | Apr 9, 2026 | Apr 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub