Critical OpenSSL Vulnerabilities in AlmaLinux: Important Security Update
Summary
ALSA-2026:67165: Important: openssl security, bug fix, and enhancement update. Affects openssl versions < 1:3.5.8-1.el9_8. Fixed in 1:3.5.8-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, along with a robust general-purpose cryptography library. It is essential for securing communications over computer networks. However, recent vulnerabilities have been identified that could compromise the security and stability of applications relying on OpenSSL, particularly in the AlmaLinux 9 ecosystem.
Vulnerability Detail
The vulnerabilities in OpenSSL include a denial of service due to unbounded memory growth in the QUIC server (CVE-2026-14456), a potential double free when processing INITIAL packets (CVE-2026-18798), and a heap buffer overflow during CMS key unwrapping (CVE-2026-63072). Additionally, there are issues related to invalid pointer dereference in the CMP server (CVE-2026-63076) and excessive memory use when buffering DTLS records (CVE-2026-54874). These vulnerabilities can lead to severe security risks, including service outages and unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1:3.5.8-1.el9_8
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the available updates as soon as possible.
Conclusion
In summary, the recent vulnerabilities in OpenSSL pose significant risks to applications running on AlmaLinux 9. It is crucial to apply the recommended updates to safeguard your systems against potential attacks. Utilizing tools like Vulert can help you monitor and manage vulnerabilities effectively.
See every vulnerability recorded for openssl →
FAQ
The main vulnerabilities include denial of service, double free errors, heap buffer overflows, and invalid pointer dereferences, which can lead to memory exhaustion and service disruptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The recommended action is to update the OpenSSL packages to version 1:3.5.8-1.el9_8 using the command 'sudo dnf update openssl openssl-devel openssl-libs openssl-perl'.
Currently, there are no known workarounds. The best approach is to apply the updates as soon as they are available.
More information can be found on the CVE pages listed in the vulnerability advisory or by visiting the OpenSSL project website.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
