Moderate Vulnerability in compat-openssl11: Heap Buffer Overflow and DTLS Issues
Summary
RLSA-2026:80514: Moderate: compat-openssl11 security update. Affects compat-openssl11 versions < 1:1.1.1k-5.el9_8.6. Fixed in 1:1.1.1k-5.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The compat-openssl11 package is a compatibility layer for OpenSSL 1.1.1, providing essential libraries for secure communications between machines. It is widely used in various applications to ensure encrypted data transmission. However, this package has been identified with vulnerabilities that could compromise its security, specifically related to heap buffer overflow and DTLS message handling.
Vulnerability Detail
The vulnerabilities in compat-openssl11 stem from two main issues: a heap buffer overflow during CMS key unwrapping (CVE-2026-63072) and a flaw in DTLS that allows retransmission of handshake messages from a stale buffer offset (CVE-2026-84782). These vulnerabilities could potentially allow an attacker to exploit the system, leading to unauthorized access or data leakage. The CVSS score for these vulnerabilities is 7.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
1:1.1.1k-5.el9_8.6
This is the first release that contains the fix.
sudo dnf update compat-openssl11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the affected functionalities until the package is updated. However, it is strongly advised to apply the patch as soon as possible to mitigate the risks associated with these vulnerabilities.
Conclusion
The compat-openssl11 package has been identified with moderate vulnerabilities that could pose security risks. It is crucial to update to the patched version to ensure the integrity and security of your applications. Regular monitoring and prompt updates are essential in maintaining a secure environment.
See every vulnerability recorded for compat-openssl11 →
FAQ
compat-openssl11 is a compatibility package for OpenSSL 1.1.1, providing libraries necessary for secure communications.
The main vulnerabilities include a heap buffer overflow in CMS key unwrapping and issues with DTLS message retransmission.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for these vulnerabilities is 7.5, indicating a moderate level of risk.
If immediate updates are not possible, limit the use of the affected functionalities and monitor for any unusual activity until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for compat-openssl11.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
