Moderate Vulnerability in compat-openssl11: Heap Buffer Overflow and DTLS Retransmit Issues
Summary
ALSA-2026:80514: Moderate: compat-openssl11 security update. Affects compat-openssl11 versions < 1:1.1.1k-5.el9_8.6. Fixed in 1:1.1.1k-5.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The compat-openssl11 package is a compatibility layer for the OpenSSL toolkit, specifically designed to support secure communications between machines. It includes libraries from version 1.1.1, ensuring that applications relying on older versions of OpenSSL can function correctly. However, this package has been identified to contain vulnerabilities that could potentially compromise the security of applications using it.
Vulnerability Detail
This vulnerability arises from two critical issues: a heap buffer overflow during CMS key unwrapping (CVE-2026-63072) and a flaw in DTLS that allows handshake messages to be retransmitted from a stale buffer offset (CVE-2026-84782). The heap buffer overflow can lead to arbitrary code execution, while the DTLS issue may allow attackers to exploit the retransmission of handshake messages, potentially leading to unauthorized access or data leakage.
How To Fix
Minimum fixed version
1:1.1.1k-5.el9_8.6
This is the first release that contains the fix.
sudo dnf update compat-openssl11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider isolating the affected applications from untrusted networks and minimizing their exposure to potential attackers until the update can be applied.
Conclusion
The compat-openssl11 package has been identified with moderate vulnerabilities that could pose significant security risks. It is crucial to update to the latest patched version to safeguard your applications. Utilize tools like Vulert to monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for compat-openssl11 →
FAQ
compat-openssl11 is a compatibility package for the OpenSSL toolkit, allowing applications that depend on older versions of OpenSSL to function with newer systems.
The vulnerabilities can lead to severe security issues, including arbitrary code execution and unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider isolating the affected applications from untrusted networks to reduce the risk of exploitation.
For detailed information, refer to the CVE pages: CVE-2026-63072 and CVE-2026-84782.
Related vulnerabilities
Recent vulnerabilities recorded for compat-openssl11.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
