CVE-2026-28390
Vulnerability Summary
Timeline
Description
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.80%• Percentile: 55%
Techniques & Countermeasures
- CWE-476•NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Systems
- alpine•openssl
≥ 1.0.2, < 3.3.7-r0 | ≥ 1.0.2, < 3.3.7-r0 | ≥ 1.0.2, < 3.5.6-r0 | ≥ 1.0.2, < 3.5.6-r0 | ≥ 1.0.2, < 3.5.6-r0
- chainguard•libcrypto3
< 3.6.2-r0
- chainguard•libcrypto3-2.34
< 3.6.2-r0
- chainguard•openssl
< 3.6.2-r0
- chainguard•openssl-provider-fips-3.4.0
< 0
- chainguard•openssl-provider-fips-3.4.0-dbg
< 0
- chainguard•openssl-provider-fips-3.6.0
< 0
- chainguard•openssl-provider-fips-3.6.0-dbg
< 0
- wolfi•libcrypto3
< 3.6.2-r0
- wolfi•openssl
< 3.6.2-r0
- debian•openssl
< 1.1.1w-0+deb11u7 | < 3.0.19-1~deb12u2 | < 3.5.5-1~deb13u2 | < 3.6.2-1
- ubuntu•edk2
all | all | all | all | all | all
- ubuntu•edk2-hwe
all
- ubuntu•nodejs
all
- ubuntu•openssl
< 1.0.2g-1ubuntu4.20+esm15 | < 1.0.2g-1ubuntu4.fips.4.20.15 | all | < 1.1.1-1ubuntu2.1~18.04.23+esm8 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.8 | < 1.1.1f-1ubuntu2.24+esm3 | < 1.1.1f-1ubuntu2.fips.24.3 | < 3.0.2-0ubuntu1.23 | < 3.0.2-0ubuntu1.23+Fips1 | < 3.0.13-0ubuntu3.9 | < 3.5.3-1ubuntu3.3 | < 3.5.5-1ubuntu3
- ubuntu•openssl-fips
all | < 3.0.13-0ubuntu3.12+Fips1
- ubuntu•openssl1.0
< 1.0.2n-1ubuntu5.13+esm4
- openssl•openssl
≥ 1.0.2, < 1.0.2zp | ≥ 1.1.1, < 1.1.1zg | ≥ 3.0.0, < 3.0.20 | ≥ 3.3.0, < 3.3.7 | ≥ 3.4.0, < 3.4.5 | ≥ 3.5.0, < 3.5.6 | ≥ 3.6.0, < 3.6.2
- redhat•compat-openssl10
< 1:1.0.2o-4.el8_10.2 | < 1:1.0.2o-4.el8_6.1 | < 1:1.0.2o-3.el8_4.1
- redhat•compat-openssl10-debuginfo
< 1:1.0.2o-4.el8_10.2 | < 1:1.0.2o-3.el8_4.1
- redhat•compat-openssl10-debugsource
< 1:1.0.2o-4.el8_10.2 | < 1:1.0.2o-3.el8_4.1
- redhat•compat-openssl11
< 1:1.1.1k-5.el9_8.3
- redhat•compat-openssl11-debuginfo
< 1:1.1.1k-5.el9_8.3
- redhat•compat-openssl11-debugsource
< 1:1.1.1k-5.el9_8.3
- redhat•openssl
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1g-18.el8_4.3 | < 1:1.1.1k-17.el8_6 | < 0:3.5.6-0.3.hum1
- redhat•openssl-debuginfo
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1g-18.el8_4.3 | < 1:1.1.1k-17.el8_6
- redhat•openssl-debugsource
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1k-17.el8_6
- redhat•openssl-devel
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1g-18.el8_4.3 | < 1:1.1.1k-17.el8_6
- redhat•openssl-libs
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1g-18.el8_4.3 | < 1:1.1.1k-17.el8_6
- redhat•openssl-libs-debuginfo
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1g-18.el8_4.3
- redhat•openssl-perl
< 1:3.5.5-3.el9_8 | < 1:3.5.5-3.el10_2 | < 1:1.1.1g-18.el8_4.3 | < 1:1.1.1k-17.el8_6
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Module for Legacy 15 SP7
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server 12 SP5-LTSS
< 1.0.2p-3.112.1
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server 15 SP4-LTSS
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server 15 SP5-LTSS
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server 15 SP6-LTSS
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6
< 1.0.2p-150000.3.111.2
- suse•openssl-1_0_0&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
< 1.0.2p-3.112.1
References (49)
- https://openssl-library.org/news/secadv/20260407.txt
- https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc
- https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6
- https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788
- https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75
- https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://www.suse.com/support/update/announcement/2026/suse-su-20263272-1/
- https://bugzilla.suse.com/1260446
- https://bugzilla.suse.com/1261678
- https://www.suse.com/security/cve/CVE-2026-28390
- https://www.suse.com/support/update/announcement/2026/suse-su-20263443-1/
- https://access.redhat.com/errata/RHSA-2026:14217
- https://images.redhat.com/
- https://access.redhat.com/security/cve/CVE-2026-28390
- https://access.redhat.com/security/updates/classification/
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14217.json
- https://bugzilla.redhat.com/show_bug.cgi?id=2456314
- https://www.cve.org/CVERecord?id=CVE-2026-28390
- https://nvd.nist.gov/vuln/detail/CVE-2026-28390
- https://access.redhat.com/errata/RHSA-2026:22312
- https://access.redhat.com/security/updates/classification/#moderate
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22312.json
- https://access.redhat.com/errata/RHSA-2026:22313
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22313.json
- https://access.redhat.com/errata/RHSA-2026:22314
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22314.json
- https://access.redhat.com/errata/RHSA-2026:22315
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22315.json
- https://access.redhat.com/errata/RHSA-2026:38503
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38503.json
- https://access.redhat.com/errata/RHSA-2026:38804
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38804.json
- https://access.redhat.com/errata/RHSA-2026:38805
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38805.json
- https://access.redhat.com/errata/RHSA-2026:43513
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43513.json
- https://access.redhat.com/errata/RHSA-2026:44480
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44480.json
- https://access.redhat.com/errata/RHSA-2026:47096
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47096.json
- https://security-tracker.debian.org/tracker/CVE-2026-28390
- https://ubuntu.com/security/CVE-2026-28390
- https://www.openwall.com/lists/oss-security/2026/04/07/11
- https://ubuntu.com/security/notices/USN-8155-1
- https://ubuntu.com/security/notices/USN-8155-2
- https://security.alpinelinux.org/vuln/CVE-2026-28390
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28390.json