Moderate Vulnerability in OpenSSL: Denial of Service Due to NULL Pointer Dereference
Summary
ALSA-2026:22312: Moderate: openssl security update. Affects openssl versions < 1:3.5.5-3.el9_8. Fixed in 1:3.5.5-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, along with a comprehensive general-purpose cryptography library. It is essential for securing communications over computer networks. The specific vulnerability in question affects OpenSSL versions prior to 1:3.5.5-3.el9_8, which could lead to a denial of service under certain conditions.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the processing of CMS EnvelopedData within OpenSSL. This flaw can be exploited to cause a denial of service, potentially leading to application crashes or unavailability. The issue is cataloged under CVE-2026-28390 and poses a moderate risk to systems relying on OpenSSL for secure communications.
How To Fix
Minimum fixed version
1:3.5.5-3.el9_8
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the use of CMS EnvelopedData processing in your applications until the patch is applied. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The OpenSSL vulnerability identified as CVE-2026-28390 poses a moderate risk due to a NULL pointer dereference that can lead to denial of service. It is crucial to update to the patched version 1:3.5.5-3.el9_8 to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for openssl →
FAQ
The vulnerability can lead to a denial of service, causing applications that rely on OpenSSL to crash or become unavailable.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider limiting the use of affected features like CMS EnvelopedData processing until the patch is applied.
While the primary risk is denial of service, it is always advisable to monitor your systems for any unusual activity that could indicate further exploitation.
For more details, refer to the CVE page for CVE-2026-28390, which provides comprehensive information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
