EN PT-BR
← Voltar ao feed
medium

OpenSSL November 2026 advisory: five Low-severity CVEs in QUIC, AES-GCM-SIV and CMS across the 1.0.2 to 4.1 branches

2 fonte(s) · 2 atualização(ões) · publicado 09/11/2026 21:00 · coletado há 11 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 00:01; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ securityonline.info ↗

On 10 November 2026 the OpenSSL Project published a security advisory covering five CVEs: CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691 and CVE-2026-95692 (cert.cyber.gouv.fr, securityonline.info). The flaws sit in the QUIC stack, AES-GCM-SIV and CMS encryption. The vendor rates the ones its index shows as Low, and securityonline.info says all five are Low. None is remote code execution, and the FIPS modules are stated not to be affected (securityonline.info). CERT-FR summarizes the impact as remote denial of service, loss of data confidentiality and security policy bypass, without mapping each CVE to an impact (cert.cyber.gouv.fr). The most relevant issue is CVE-2026-95691, a use-after-free read in the QUIC client that a malicious server can trigger. No exploitation in the wild is reported in either source. The sources disagree on whether fixed releases are already available (see Conflicting Reports).

Entenda a falha

A vulnerabilidade

OpenSSL's 10 November 2026 advisory fixes five CVEs, all reported as Low by securityonline.info (CERT-FR confirmed Low only for three of them). The most relevant is CVE-2026-95691: a malicious QUIC server can trigger a heap use-after-free read in the QUIC client, causing a crash or a one-byte heap disclosure. It affects 4.1.0 before 4.1.1, 4.0.0 before 4.0.4 and 3.5.0 before 3.5.10. CVE-2026-107496 is an infinite loop in CMS_encrypt()/CMS_encrypt_ex() when the recipient EC certificate declares a group order of 1, which causes CPU denial of service. It affects all branches, from 1.0.2 to 4.1. CVE-2026-88823 allows AAD forgery in AES-GCM-SIV after a zero-length incremental AAD update. CVE-2026-88822 makes the QUIC handshake use uninitialized stack bytes for peer address auto-detection on an already-connected socket. CVE-2026-95692 is not confirmed; it is probably a second AES-GCM-SIV flaw, an out-of-bounds read with wrong IV length handling. Fixed in 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk and 1.0.2zt. FIPS modules are stated as not affected.

Como funciona

For CVE-2026-95691, a QUIC client completes a handshake with a malicious server, which sends a retransmitted CRYPTO frame overlapping an existing one. Handling the overlap can release a buffer that the TLS record layer still points to, so the client later reads freed heap memory. For CVE-2026-107496, an application encrypts a CMS message to a recipient whose EC certificate declares a group order of 1, and the code loops without ending. For CVE-2026-88823, AES-GCM-SIV receives an incremental AAD update of zero length, and the resulting state lets the AAD be forged. For CVE-2026-88822, the handshake on an already-connected socket runs peer address auto-detection and reads uninitialized stack bytes. Exposure of AES-GCM-SIV is narrow: only applications calling EVP_CipherInit_ex() (or the provider equivalent) with an IV length other than 12 bytes.

Por que é vulnerável

CVE-2026-95691 is memory used after being freed: the handling of an overlapping retransmitted CRYPTO frame releases a buffer that is still referenced. CVE-2026-107496 is an infinite loop (CWE-835) from not handling a degenerate EC group order of 1. CVE-2026-88823 is classed as CWE-325, a missing cryptographic step in the zero-length AAD update path. CVE-2026-88822 is use of uninitialized stack memory in QUIC address detection. The articles do not explain why these went unnoticed or what each patch changes in detail.

Onde está

CVE-2026-95691 is fixed in OpenSSL pull request #33543 (merged 9 November 2026); the other flaws are in CMS_encrypt()/CMS_encrypt_ex(), the AES-GCM-SIV implementation (EVP_CipherInit_ex() path) and the QUIC stack, with fix commits public on GitHub but no file names given.

Como foi descoberta

CVE-2026-95691 was found by Filipe Casal (Trail of Bits); the fix was authored by Sashan with Filipe Casal and reviewed by Tomas Mraz, Andrew Dinh and Eugene Syromiatnikov. CVE-2026-107496 was reported by Yinxi Liu and fixed by Jakub Zelenka. CVE-2026-88823 was found by Jérémy Jean (ANSSI), Bhargava Shastry and Jonathan Bateman (Rochester Institute of Technology) and fixed by Daniel Kubec. The articles do not say who found CVE-2026-88822 or CVE-2026-95692. The OpenSSL Project published the advisory on 10 November 2026 and CERT-FR issued a notice the same day. No exploitation in the wild is reported. The sources disagree on releases: securityonline.info says they are due 1 December 2026, while CERT-FR cites fixed versions for every branch without saying whether they are published.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:16.

Detalhes técnicos

  • CVE-2026-95691 (QUIC client, Low): a malicious QUIC server can trigger a heap use-after-free read. A retransmitted CRYPTO frame overlapping an existing frame can release a buffer the TLS record layer still points to, causing a crash or a one-byte heap disclosure during handshake processing (securityonline.info, citing openssl-library.org). Found by Filipe Casal (Trail of Bits). Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4 and 3.5.0 before 3.5.10 (securityonline.info). The fix is pull request #33543, authored by Sashan with Filipe Casal, reviewed by Tomas Mraz, Andrew Dinh and Eugene Syromiatnikov, and merged on 9 November 2026 (securityonline.info).
  • CVE-2026-107496 (CMS, Low): CMS_encrypt() and CMS_encrypt_ex() loop forever when the recipient EC certificate declares a group order of 1 (CWE-835). This wastes CPU and causes denial of service, and the attacker must supply the recipient certificate (cert.cyber.gouv.fr, securityonline.info). Reported by Yinxi Liu, fix by Jakub Zelenka. It is the only CVE affecting all six branches: 4.1, 4.0, 3.5, 3.0, 1.1.1 and 1.0.2. The vendor states the OpenSSL TLS and QUIC implementations do not use this path (securityonline.info).
  • CVE-2026-88823 (AES-GCM-SIV, Low): the additional authenticated data (AAD) can be forged after a zero-length incremental AAD update (CWE-325). Found by Jérémy Jean (ANSSI), Bhargava Shastry and Jonathan Bateman (Rochester Institute of Technology); fix by Daniel Kubec (cert.cyber.gouv.fr).
  • CVE-2026-88822 (QUIC, Low): when a socket is already connected, peer address auto-detection during the handshake uses uninitialized stack bytes. Fixed in 3.5.10 (cert.cyber.gouv.fr, quoting a third-party issue that cites the vendor).
  • CVE-2026-95692: its description was not visible to CERT-FR, so its impact and prerequisites are unconfirmed (cert.cyber.gouv.fr). securityonline.info describes a second AES-GCM-SIV flaw, an out-of-bounds read with incorrect IV length handling, but does not give its CVE ID. It is likely, but not confirmed by either source, that this is CVE-2026-95692.
  • AES-GCM-SIV exposure is narrow. Per the vendor page, only applications calling EVP_CipherInit_ex() (or the provider equivalent) with an IV length other than 12 bytes are affected, and no OpenSSL-implemented protocol uses AES-GCM-SIV (securityonline.info).
  • Per securityonline.info, 4.1, 4.0 and 3.5 are affected by all five flaws, while 3.0, 1.1.1 and 1.0.2 are affected only by CVE-2026-107496.

Remediação

  • Upgrade to the fixed release for your branch: 4.1.1 (from 4.1.0), 4.0.4 (from 4.0.0), 3.5.10 (from 3.5.0), 3.0.24 (from 3.0.0), 1.1.1zk (from 1.1.1) or 1.0.2zt (from 1.0.2) (cert.cyber.gouv.fr, citing the vendor index).
  • Until the patched builds are available in your environment, prioritize systems that use the QUIC client, CMS encryption to externally supplied EC recipient certificates, or AES-GCM-SIV with non-12-byte IVs.
  • The fix commits are already public in the OpenSSL GitHub repository (securityonline.info), but build from them only if you can validate the result.

Relatos divergentes

  • Release status: securityonline.info says fixed releases are scheduled for 1 December 2026 while the fixes already sit in the public repository. cert.cyber.gouv.fr cites the vendor index as listing fixed releases for every branch, with git commits for 4.1.1, 4.0.4 and 3.5.10, without saying whether they are published. Check the OpenSSL project directly for current availability.
  • Severity: securityonline.info says all five are Low. cert.cyber.gouv.fr confirmed Low only for CVE-2026-107496, CVE-2026-88822 and CVE-2026-88823, because the severity of CVE-2026-95691 and CVE-2026-95692 was not visible in its excerpt.
  • CVE mapping: securityonline.info gives no CVE IDs for the two AES-GCM-SIV flaws. cert.cyber.gouv.fr ties CVE-2026-88823 to AES-GCM-SIV and CVE-2026-88822 to QUIC, so the mapping of CVE-2026-95692 remains unconfirmed.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

    OpenSSL security release fixes five CVEs across the 1.0.2 to 4.1 branches, mostly rated low severity

    ler a análise desta fonte

    On 10 November 2026 OpenSSL published a security advisory covering five CVEs, CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691 and CVE-2026-95692, that affect the 1.0.2, 1.1.1, 3.0, 3.5, 4.0 and 4.1 branches. CERT-FR summarizes the impact as remote denial of service, data confidentiality loss and security policy bypass, but does not map each CVE to one of those impacts. The vendor's vulnerability index rates the three entries I could read (CVE-2026-107496, CVE-2026-88822 and CVE-2026-88823) as Low (openssl-library.org/news/vulnerabilities; github.com/Tom-Joad/PanaControl/issues/59 quoting the vendor index), and the severity of CVE-2026-95691 and CVE-2026-95692 was not visible in the page excerpt. Each flaw needs a specific feature or input, such as CMS encryption to a crafted EC recipient certificate, a QUIC connection, or AES-GCM-SIV use, so the exposure is narrower than the headline suggests. No exploitation in the wild is reported in the sources opened. The OpenSSL secadv text could not be fetched during research.

    Technical Details

    • CVE-2026-107496 (Low): an infinite loop in CMS_encrypt() and CMS_encrypt_ex() when the recipient EC certificate declares a group order of 1, letting whoever supplies that certificate tie up CPU (CWE-835). Found by Yinxi Liu; fix by Jakub Zelenka (openssl-library.org/news/vulnerabilities).
    • CVE-2026-88823 (Low): forgery of the additional authenticated data in AES-GCM-SIV after a zero-length incremental AAD update (CWE-325). Found by Jérémy Jean (ANSSI), Bhargava Shastry and Jonathan Bateman (Rochester Institute of Technology); fix by Daniel Kubec. The FIPS modules are stated not to be affected (openssl-library.org/news/vulnerabilities).
    • CVE-2026-88822 (Low): in the QUIC stack, when a socket is already connected, peer address auto-detection during the handshake uses uninitialized stack bytes, fixed in 3.5.10 (github.com/Tom-Joad/PanaControl/issues/59, quoting openssl-library.org).
    • CVE-2026-95691: a malicious QUIC server can trigger a heap-use-after-free read in the OpenSSL QUIC client; FIPS modules are stated not to be affected (openssl-library.org/news/vulnerabilities).
    • CVE-2026-95692: the vendor excerpt opened did not include its description, so its impact and prerequisites are not confirmed here.

    Fix Details

    The vendor vulnerability index lists fixed releases for every branch: 4.1.1 (from 4.1.0), 4.0.4 (from 4.0.0), 3.5.10 (from 3.5.0), 3.0.24 (from 3.0.0), 1.1.1zk (from 1.1.1) and 1.0.2zt (from 1.0.2), with git commits cited for the 4.1.1, 4.0.4 and 3.5.10 releases (openssl-library.org/news/vulnerabilities). The pull requests and commits themselves were not opened, so no PR number, opening or merge dates are given. The vendor index also names the fix developers of CVE-2026-107496 and CVE-2026-88823. The article's version ranges match these fixed releases.

    Remediation

    Upgrade to 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt according to the branch in use, and rebuild or update packages that statically link OpenSSL. Prioritise services that process CMS messages from untrusted parties, QUIC endpoints and AES-GCM-SIV use, since those are the stated trigger conditions. Consult the OpenSSL secadv bulletin of 10 November 2026 for the full text, which could not be retrieved during research.

  2. securityonline.info ↗ · pub. 10/11/2026 11:23 · coletado 10/11 13:02 primeiro registro só resumo do feed

    OpenSSL November 2026 advisory fixes five Low-severity flaws in QUIC, AES-GCM-SIV and CMS

    ler a análise desta fonte

    The OpenSSL Project published its November 2026 security advisory on November 10, 2026 (securityonline.info), covering five flaws that all carry a Low severity rating: two in the QUIC stack, two in the AES-GCM-SIV modes and one infinite loop in CMS encryption. The vendor's own rating is Low for each, and the article's framing matches it: none of the five is a remote code execution bug, and the FIPS modules are not affected (openssl-library.org). The most relevant issue is CVE-2026-95691, a heap use-after-free read in the QUIC client that a malicious QUIC server can trigger, with a crash or one-byte heap disclosure as the outcome (openssl-library.org). CVE-2026-107496 makes CMS_encrypt() loop forever when the recipient's EC certificate declares a group order of 1, so an attacker must supply the recipient certificate (openssl-library.org). The CVE identifiers of the two AES-GCM-SIV flaws are not given in the article or in the vendor pages reviewed. Fixed releases are scheduled for December 1, 2026, while the fixes already sit in the public OpenSSL GitHub repository (securityonline.info).

    Technical Details

    • CVE-2026-95691 (QUIC client, Low): a retransmitted CRYPTO frame that overlaps an existing frame can release the buffer that the TLS record layer still points to, which leads to a use-after-free read during handshake processing (openssl-library.org). Found by Filipe Casal (Trail of Bits). Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4 and 3.5.0 before 3.5.10 (openssl-library.org).
    • CVE-2026-107496 (CMS, Low): a recipient EC certificate with a group order of 1 makes CMS_encrypt() or CMS_encrypt_ex() loop indefinitely, consuming CPU and causing denial of service (openssl-library.org). Reported by Yinxi Liu, fix developed by Jakub Zelenka. Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4, 3.5.0 before 3.5.10, 3.0.0 before 3.0.24, 1.1.1 before 1.1.1zk and 1.0.2 before 1.0.2zt (openssl-library.org). The vendor states the OpenSSL TLS and QUIC implementations do not use this path (openssl-library.org).
    • AES-GCM-SIV flaws (Low): the article names an AAD forgery after a zero-length incremental AAD update and an out-of-bounds read with incorrect IV length handling. The vendor page says only applications calling EVP_CipherInit_ex() (or the provider equivalent) with an IV length other than 12 bytes for AES-GCM-SIV are affected (openssl-library.org). No OpenSSL-implemented protocol uses AES-GCM-SIV (openssl-library.org).
    • Per the article, OpenSSL 4.1, 4.0 and 3.5 are affected by all five flaws, while 3.0, 1.1.1 and 1.0.2 are affected only by CVE-2026-107496 (securityonline.info).

    Fix Details

    • CVE-2026-95691: the fix is pull request #33543 (github.com/openssl/openssl/pull/33543), authored by Sashan and co-authored with Filipe Casal (Trail of Bits), who reported the flaw. Reviewers were Tomas Mraz, Andrew Dinh and Eugene Syromiatnikov. It was merged on November 9, 2026 (github.com/openssl/openssl/pull/33543). The change reintroduces a range-locking mechanism so that a stream range read through the peek path is not replaced while the record layer still uses it (github.com/openssl/openssl/pull/33543). The vendor page lists 4.1.1, 4.0.4 and 3.5.10 as the fixed releases for this flaw (openssl-library.org). I did not open the GitHub releases page, so the publication of these releases is not confirmed here.
    • CVE-2026-107496: the vendor page cites the fix commits and lists 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk and 1.0.2zt as the fixed versions (openssl-library.org). I did not open the commit pages, so the pull request for this fix is not identified.
    • AES-GCM-SIV flaws: the advisory and article do not name the release that carries these fixes beyond the scheduled December 1 date (securityonline.info).

    Remediation

    • Plan to upgrade to 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt once they are published, since the official releases are scheduled for December 1, 2026 (securityonline.info, openssl-library.org).
    • Prioritize hosts running OpenSSL QUIC clients that connect to untrusted servers, and services that run CMS_encrypt() with recipient certificates that are not trusted.
    • Check whether any application calls AES-GCM-SIV with a non-12-byte IV length, since only those callers are affected by the vendor's description.