Critical Vulnerability in compat-openssl10: Heap Use-After-Free in PKCS7_verify()
Summary
ALSA-2026:36215: Important: compat-openssl10 security update. Affects compat-openssl10 versions < 1:1.0.2o-4.el8_10.3. Fixed in 1:1.0.2o-4.el8_10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The compat-openssl10 package is a compatibility layer for OpenSSL, designed to support secure communications between machines. It provides libraries that allow older software to function with newer systems that may not support OpenSSL-1.1. This package is crucial for maintaining the integrity and security of data in transit, especially in legacy applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-45447 is a Heap Use-After-Free issue in the PKCS7_verify() function of OpenSSL. This flaw can lead to potential exploitation, allowing attackers to execute arbitrary code or cause a denial of service by manipulating the memory management of the application. The vulnerability arises from improper handling of memory, which can be exploited if an attacker can control the input to the PKCS7_verify() function.
How To Fix
Minimum fixed version
1:1.0.2o-4.el8_10.3
This is the first release that contains the fix.
sudo dnf update compat-openssl10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating the package is not immediately possible, consider isolating the affected applications from untrusted inputs or disabling features that utilize the PKCS7_verify() function until the package can be updated.
Conclusion
The compat-openssl10 package has a critical vulnerability that needs immediate attention. Updating to the latest patched version is essential to maintain the security of applications relying on this package. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for compat-openssl10 →
FAQ
CVE-2026-45447 is a security vulnerability in the compat-openssl10 package that allows for a Heap Use-After-Free condition in the PKCS7_verify() function.
Exploitation of this vulnerability can lead to arbitrary code execution or denial of service, potentially compromising the security of your application.
Yes, a patched version of the compat-openssl10 package is available. Updating to version 1:1.0.2o-4.el8_10.3 will resolve the issue.
If immediate updates are not feasible, consider implementing workarounds such as isolating affected applications or disabling vulnerable features.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for compat-openssl10.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
