Moderate Vulnerability in compat-openssl10: Denial of Service Risk
Summary
ALSA-2026:22315: Moderate: compat-openssl10 security update. Affects compat-openssl10 versions < 1:1.0.2o-4.el8_10.2. Fixed in 1:1.0.2o-4.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The compat-openssl10 package is a compatibility layer for OpenSSL, designed to support secure communications between machines. It provides libraries that allow older software to function with newer OpenSSL versions, specifically for applications that cannot be compiled with OpenSSL-1.1. This package is crucial for maintaining secure connections in legacy systems, but it is susceptible to vulnerabilities that can compromise security.
Vulnerability Detail
The vulnerability identified as CVE-2026-28390 involves a Denial of Service (DoS) condition caused by a NULL pointer dereference during the processing of CMS EnvelopedData. This flaw can be exploited by attackers to crash the application or service using the affected OpenSSL libraries, leading to service interruptions and potential data exposure. The risk is particularly significant for systems relying on the compat-openssl10 package for secure communications.
How To Fix
Minimum fixed version
1:1.0.2o-4.el8_10.2
This is the first release that contains the fix.
sudo dnf update compat-openssl10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling any services that rely on the compat-openssl10 package until the package can be updated. This will help mitigate the risk of exploitation while you prepare to apply the patch.
Conclusion
The compat-openssl10 package has a moderate vulnerability that can lead to Denial of Service attacks. It is crucial to update to the patched version to mitigate risks. Temporary workarounds can help manage the situation until the update is applied. Regular monitoring for vulnerabilities is recommended to maintain system security.
See every vulnerability recorded for compat-openssl10 →
FAQ
CVE-2026-28390 is a vulnerability in the compat-openssl10 package that can lead to a Denial of Service due to a NULL pointer dereference.
Exploitation of this vulnerability can cause applications to crash, leading to service interruptions and potential data exposure.
Yes, a patched version of the compat-openssl10 package is available. Updating to version 1:1.0.2o-4.el8_10.2 or later will resolve the issue.
If immediate updates are not possible, consider disabling services that depend on the compat-openssl10 package as a temporary measure.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can also check your application for this specific vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for compat-openssl10.
