Critical Vulnerability in OpenSSL: Arbitrary Code Execution and Denial of Service Risks
Summary
RLSA-2026:1473: Important: openssl security update. Affects openssl versions < 1:3.5.1-7.el9_7. Fixed in 1:3.5.1-7.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, providing essential cryptographic functions for secure communications over networks. It is integral to many applications and services, ensuring data integrity and confidentiality. However, recent vulnerabilities have exposed OpenSSL to significant risks, including arbitrary code execution and denial of service, particularly through crafted PKCS#12 files and other malformed inputs.
Vulnerability Detail
The vulnerabilities in OpenSSL stem from various issues, including arbitrary code execution through crafted PKCS#12 files (CVE-2025-11187), remote code execution via oversized Initialization Vectors in CMS parsing (CVE-2025-15467), and multiple denial of service scenarios due to NULL pointer dereferences, excessive memory allocations, and out-of-bounds writes. These vulnerabilities can lead to severe ramifications, such as unauthorized access to sensitive data, service interruptions, and potential exploitation by malicious actors.
How To Fix
Minimum fixed version
1:3.5.1-7.el9_7
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to services that utilize OpenSSL until the package is updated. Additionally, avoid processing untrusted or malformed PKCS#12 files to mitigate immediate risks.
Conclusion
The recent vulnerabilities in OpenSSL pose significant risks, including arbitrary code execution and denial of service. It is crucial for users to update to the latest patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a toolkit that implements SSL and TLS protocols, providing cryptographic functions for secure communications.
The vulnerabilities include arbitrary code execution, denial of service, and data integrity bypass, primarily through crafted files and malformed inputs.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for the vulnerabilities in this OpenSSL update is 9.8, indicating a critical severity level.
It is recommended to regularly check for updates and apply them promptly to mitigate security risks associated with vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
