Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-perlUpgrade compat-openssl11Upgrade openssl-develUpgrade openssl-libsUpgrade compat-openssl10Upgrade openssl | Jun 3, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade openssl | Apr 10, 2026 | Apr 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl-snapsafe-debuginfoUpgrade edk2-aarch64Upgrade openssl-libsUpgrade edk2-ovmfUpgrade openssl-snapsafe-libsUpgrade edk2-tools-docUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-snapsafeUpgrade edk2-toolsUpgrade openssl11-libsUpgrade openssl-staticUpgrade openssl11-develUpgrade openssl11-debuginfoUpgrade openssl-debuginfoUpgrade openssl-snapsafe-develUpgrade opensslUpgrade edk2-debuginfoUpgrade openssl11Upgrade openssl11-staticUpgrade openssl-snapsafe-staticUpgrade openssl-snapsafe-perl | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-debugsourceUpgrade opensslUpgrade openssl-develUpgrade openssl-snapsafe-libsUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-latestUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-libsUpgrade openssl-debuginfo | Apr 14, 2026 | Apr 7, 2026 |
| Debian | — | Upgrade openssl | Apr 9, 2026 | Apr 9, 2026 |
| Freebsd | — | Upgrade openssl34Upgrade openssl36Upgrade openssl111Upgrade openssl35Upgrade openssl | Apr 8, 2026 | Apr 7, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Apr 9, 2026 | Apr 7, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory47 | May 6, 2026 | May 4, 2026 |
| Oracle Missing Cpu Jul 2026 | — | Apply the July 2026 Critical Patch Update (CPU) for Oracle Database | Jul 22, 2026 | Apr 7, 2026 |
| Oracle_linux | — | Upgrade compat-openssl10 | Jun 4, 2026 | Apr 7, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Sep 7, 2026 | Apr 7, 2026 |
| Redhat_linux | — | Upgrade compat-openssl11-debuginfoUpgrade openssl-perlUpgrade openssl-libsUpgrade edk2-debugsourceNo solution existsUpgrade openssl-staticUpgrade opensslUpgrade compat-openssl10Upgrade compat-openssl10-debuginfoUpgrade compat-openssl11-debugsourceUpgrade compat-openssl11Upgrade edk2-aarch64Upgrade edk2-toolsUpgrade compat-openssl10-debugsourceUpgrade openssl-debugsourceUpgrade edk2-ovmfUpgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade edk2-tools-docUpgrade openssl-debuginfoUpgrade edk2-tools-debuginfo | Jun 3, 2026 | Apr 7, 2026 |
| Rocky_linux | — | Upgrade openssl-libsUpgrade compat-openssl11-debugsourceUpgrade compat-openssl11Upgrade openssl-perlUpgrade compat-openssl10Upgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade compat-openssl10-debugsourceUpgrade opensslUpgrade compat-openssl10-debuginfoUpgrade openssl-debuginfoUpgrade compat-openssl11-debuginfoUpgrade openssl-debugsource | Jun 4, 2026 | Jun 2, 2026 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 10.0.8Upgrade Splunk Universal Forwarder to version 9.4.13Upgrade Splunk Universal Forwarder to version 10.2.5Upgrade Splunk Universal Forwarder to version 9.4.14Upgrade Splunk Universal Forwarder to version 10.2.6Upgrade Splunk Universal Forwarder to version 10.0.9Upgrade Splunk Universal Forwarder to version 10.4.2Upgrade Splunk Universal Forwarder to version 10.4.1 | Jul 30, 2026 | Apr 7, 2026 |
| Ubuntu | — | Upgrade libssl3Upgrade libssl1.1 (Ubuntu Pro)Upgrade openssl (Ubuntu Pro)Upgrade openssl1.0 (Ubuntu Pro)Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade opensslUpgrade libssl3t64 | Apr 9, 2026 | Apr 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub