Linux · Security advisory · September 15, 2026
RLSA-2026:67154: openssl security update
RLSA-2026:67154, released September 15, 2026, fixes 9 CVEs in openssl (version 1:3.5.8-1.el10_2). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0170
77th percentile
Priority of the 9 CVEs
Patch now 0
Urgent 0
High 9
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| openssl | rocky 10 | 1:3.5.8-1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-18798 | openssl: Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial... | 7.5 | 0.0170 | None reported | |
| High | CVE-2026-63076 | Invalid Pointer Dereference in CMP Server via Crafted protectionAlg | 7.5 | 0.0160 | None reported | |
| High | CVE-2026-14457 | RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate | 7.5 | 0.0117 | None reported | |
| High | CVE-2026-63073 | Untrusted Sender DN Used as Format String in CMP Response Validation | 9.8 | 0.0116 | None reported | |
| High | CVE-2026-63072 | Heap Buffer Overflow in CMS Key Unwrapping | 7.5 | 0.0092 | None reported | |
| High | CVE-2026-14456 | Unbounded Memory Growth in QUIC Server Incoming Channel Queue | 7.5 | 0.0073 | None reported | |
| High | CVE-2026-54874 | Excessive Memory Use Buffering DTLS Records for a Future Epoch | 7.5 | 0.0062 | None reported | |
| High | CVE-2026-63074 | CMP Indefinite Cache Growth of ExtraCerts | 7.5 | 0.0059 | None reported | |
| High | CVE-2026-63075 | QUIC ACK-only Packet Retention Can Cause Memory Exhaustion | 7.5 | 0.0057 | None reported |
Showing 1 to 9 of 9
1