Linux · Security advisory · June 24, 2026

RHSA-2026:25237: openssl security update

RHSA-2026:25237, released June 24, 2026, fixes 11 CVEs in openssl (version 3.5.5-4.el10_2). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0117
67th percentile

Priority of the 11 CVEs

Patch now 0 Urgent 0 High 11 Routine 0

Fixed package versions

ProductReleaseFixed in
opensslRHEL 103.5.5-4.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-42764 openssl: Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the Op... 9.1 0.0117 None reported
High CVE-2026-42766 Possible NULL Dereference in Password-Based CMS Decryption 9.1 0.0106 None reported
High CVE-2026-34180 Heap Buffer Over-read in ASN.1 Content Parsing 9.1 0.0103 None reported
High CVE-2026-7383 Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion 9.1 0.0080 None reported
High CVE-2026-42768 Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() 9.1 0.0080 None reported
High CVE-2026-9076 Out-of-Bounds Read in CMS Password-Based Decryption 9.1 0.0071 None reported
High CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption 9.1 0.0056 None reported
High CVE-2026-42769 openssl: Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate M... 9.1 0.0054 None reported
High CVE-2026-42770 openssl: Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly ch... 9.1 0.0050 None reported
High CVE-2026-45446 Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes 9.1 0.0044 None reported
High CVE-2026-34181 PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys 9.1 0.0038 None reported
Showing 1 to 11 of 11 1