Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.
Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.
The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.
An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.
Applications that process password-encrypted CMS messages may be affected.
The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-libsUpgrade opensslUpgrade openssl-perlUpgrade openssl-devel | Jun 16, 2026 | Jun 11, 2026 |
| Alpine Linux | — | Upgrade openssl | Jun 18, 2026 | Jun 9, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl11Upgrade openssl11-staticUpgrade opensslUpgrade openssl-snapsafeUpgrade edk2-debuginfoUpgrade edk2-ovmfUpgrade openssl-snapsafe-staticUpgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-develUpgrade openssl11-libsUpgrade openssl-perlUpgrade openssl-staticUpgrade edk2-aarch64Upgrade edk2-tools-docUpgrade openssl-snapsafe-debuginfoUpgrade openssl-libsUpgrade openssl-develUpgrade openssl11-debuginfoUpgrade openssl-debuginfoUpgrade edk2-toolsUpgrade openssl-snapsafe-libsUpgrade openssl11-devel | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-fips-provider-latestUpgrade openssl-perlUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-snapsafe-libsUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-libs-debuginfoUpgrade openssl | Jun 23, 2026 | Jun 9, 2026 |
| Debian | — | Upgrade openssl | Jun 16, 2026 | Jun 16, 2026 |
| Freebsd | — | Upgrade openssl36Upgrade openssl40Upgrade opensslUpgrade FreeBSDUpgrade openssl34Upgrade openssl35Upgrade openssl111 | Jun 15, 2026 | Jun 10, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 10, 2026 | Jun 9, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory48 | Jul 22, 2026 | Jul 21, 2026 |
| Oracle Missing Cpu Jul 2026 | — | Apply the July 2026 Critical Patch Update (CPU) for Oracle Database | Jul 22, 2026 | Jun 9, 2026 |
| Redhat_linux | — | Upgrade opensslNo solution existsUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-debuginfoUpgrade openssl-libs | Jun 17, 2026 | Jun 9, 2026 |
| Rocky_linux | — | Upgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-perlUpgrade openssl-libs | Jun 17, 2026 | Jun 13, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.9Upgrade Splunk Enterprise to version 10.4.2Upgrade Splunk Enterprise to version 9.4.14Upgrade Splunk Enterprise to version 10.2.6 | Aug 20, 2026 | Jun 9, 2026 |
| Ubuntu | — | Upgrade opensslUpgrade libssl3t64Upgrade openssl (Ubuntu Pro)Upgrade openssl1.0 (Ubuntu Pro)Upgrade libssl3 | Jun 16, 2026 | Jun 9, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 18, 2026 | Jun 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub