Critical OpenSSL Vulnerability: Use After Free and Heap Use-After-Free Issues

openssl Updated 17 Jun 2026

Summary

16/06/2026

Disclosed on

N/A

Severity

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

ALSA-2026:26275: Important: openssl security update. Affects openssl versions < 1:1.1.1k-16.el8_6. Fixed in 1:1.1.1k-16.el8_6. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, providing essential cryptographic functions for secure communications over networks. It is integral to many applications and services, ensuring data integrity and confidentiality. However, vulnerabilities in OpenSSL can lead to severe security risks, including unauthorized access and data breaches.

Vulnerability Detail

The identified vulnerabilities in OpenSSL include a Use After Free issue with SSL_free_buffers (CVE-2024-4741) and a Heap Use-After-Free in the OpenSSL PKCS7_verify() function (CVE-2026-45447). These vulnerabilities can potentially allow attackers to exploit memory management flaws, leading to arbitrary code execution or denial of service, thereby compromising the security of applications relying on OpenSSL.

How To Fix

Minimum fixed version

1:1.1.1k-16.el8_6

This is the first release that contains the fix.

sudo dnf update openssl

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, consider disabling the functionalities that utilize the affected OpenSSL features until the update can be applied. However, this is not a long-term solution and should be addressed promptly.

Conclusion

The OpenSSL vulnerabilities present significant security risks that must be addressed promptly. Updating to the patched version is crucial to maintaining the integrity and security of applications that rely on OpenSSL. Utilize tools like Vulert to monitor and manage vulnerabilities effectively.

See every vulnerability recorded for openssl →