EN PT-BR
← Voltar ao feed
medium

OpenSSL November 2026 advisory fixes five Low-severity flaws in QUIC, AES-GCM-SIV and CMS

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 11:23 · coletado há 2 horas

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

The OpenSSL Project published its November 2026 security advisory on November 10, 2026 (securityonline.info), covering five flaws that all carry a Low severity rating: two in the QUIC stack, two in the AES-GCM-SIV modes and one infinite loop in CMS encryption. The vendor's own rating is Low for each, and the article's framing matches it: none of the five is a remote code execution bug, and the FIPS modules are not affected (openssl-library.org). The most relevant issue is CVE-2026-95691, a heap use-after-free read in the QUIC client that a malicious QUIC server can trigger, with a crash or one-byte heap disclosure as the outcome (openssl-library.org). CVE-2026-107496 makes CMS_encrypt() loop forever when the recipient's EC certificate declares a group order of 1, so an attacker must supply the recipient certificate (openssl-library.org). The CVE identifiers of the two AES-GCM-SIV flaws are not given in the article or in the vendor pages reviewed. Fixed releases are scheduled for December 1, 2026, while the fixes already sit in the public OpenSSL GitHub repository (securityonline.info).

Entenda a falha

A vulnerabilidade

The November 2026 OpenSSL advisory fixes five flaws, all rated Low by the vendor. CVE-2026-95691 is a heap use-after-free read in the QUIC client. A malicious QUIC server can trigger it and cause a crash or a one-byte heap disclosure. It affects 4.1.0 before 4.1.1, 4.0.0 before 4.0.4 and 3.5.0 before 3.5.10. CVE-2026-107496 is an infinite loop in CMS_encrypt() and CMS_encrypt_ex() when the recipient's EC certificate declares a group order of 1. The attacker must supply that certificate, and the result is CPU exhaustion and denial of service. It also affects 3.0 (fixed in 3.0.24), 1.1.1 (1.1.1zk) and 1.0.2 (1.0.2zt). Two AES-GCM-SIV flaws, an AAD forgery and an out-of-bounds read, have no CVE IDs in the sources. Per the vendor, they only affect callers using an IV length other than 12 bytes. The FIPS modules are not affected.

Como funciona

In the QUIC case, a client is performing a handshake and the server sends CRYPTO frames. If the server retransmits a CRYPTO frame that overlaps one already stored, the QUIC stack can release the buffer that the TLS record layer is still pointing to. The record layer then reads from freed memory while processing the handshake. In the CMS case, an application encrypts data to a recipient whose EC certificate has a group order of 1. CMS_encrypt() then never finishes its computation and spins on the CPU. For AES-GCM-SIV, the sources only say that the problem arises when the cipher is initialised with an IV length other than 12 bytes. They do not describe the internal steps.

Por que é vulnerável

For CVE-2026-95691, the cause is a lifetime error: a stream range read through the peek path could be replaced by an overlapping retransmitted frame while the record layer still used it. The fix reintroduces a range-locking mechanism so that such a range is not replaced while in use. For CVE-2026-107496, the sources point to missing handling of an EC group order of 1, which lets the encryption loop run forever. For the AES-GCM-SIV flaws, the articles describe an AAD forgery after a zero-length incremental AAD update and incorrect IV length handling, but they do not give the root cause.

Onde está

The CVE-2026-95691 fix is public pull request #33543 in the openssl/openssl GitHub repository, merged on November 9, 2026. The affected functions for CVE-2026-107496 are CMS_encrypt() and CMS_encrypt_ex(). The AES-GCM-SIV issue involves EVP_CipherInit_ex() (or the provider equivalent) with a non-12-byte IV.

Como foi descoberta

CVE-2026-95691 was found and reported by Filipe Casal of Trail of Bits, who also co-authored the fix with Sashan. CVE-2026-107496 was reported by Yinxi Liu, and Jakub Zelenka developed the fix. The sources do not say who found the AES-GCM-SIV flaws. The OpenSSL Project published the advisory on November 10, 2026. Fixed releases are scheduled for December 1, 2026, while the fixes are already in the public GitHub repository.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:21.

Detalhes técnicos

  • CVE-2026-95691 (QUIC client, Low): a retransmitted CRYPTO frame that overlaps an existing frame can release the buffer that the TLS record layer still points to, which leads to a use-after-free read during handshake processing (openssl-library.org). Found by Filipe Casal (Trail of Bits). Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4 and 3.5.0 before 3.5.10 (openssl-library.org).
  • CVE-2026-107496 (CMS, Low): a recipient EC certificate with a group order of 1 makes CMS_encrypt() or CMS_encrypt_ex() loop indefinitely, consuming CPU and causing denial of service (openssl-library.org). Reported by Yinxi Liu, fix developed by Jakub Zelenka. Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4, 3.5.0 before 3.5.10, 3.0.0 before 3.0.24, 1.1.1 before 1.1.1zk and 1.0.2 before 1.0.2zt (openssl-library.org). The vendor states the OpenSSL TLS and QUIC implementations do not use this path (openssl-library.org).
  • AES-GCM-SIV flaws (Low): the article names an AAD forgery after a zero-length incremental AAD update and an out-of-bounds read with incorrect IV length handling. The vendor page says only applications calling EVP_CipherInit_ex() (or the provider equivalent) with an IV length other than 12 bytes for AES-GCM-SIV are affected (openssl-library.org). No OpenSSL-implemented protocol uses AES-GCM-SIV (openssl-library.org).
  • Per the article, OpenSSL 4.1, 4.0 and 3.5 are affected by all five flaws, while 3.0, 1.1.1 and 1.0.2 are affected only by CVE-2026-107496 (securityonline.info).

Detalhes da correção

  • CVE-2026-95691: the fix is pull request #33543 (github.com/openssl/openssl/pull/33543), authored by Sashan and co-authored with Filipe Casal (Trail of Bits), who reported the flaw. Reviewers were Tomas Mraz, Andrew Dinh and Eugene Syromiatnikov. It was merged on November 9, 2026 (github.com/openssl/openssl/pull/33543). The change reintroduces a range-locking mechanism so that a stream range read through the peek path is not replaced while the record layer still uses it (github.com/openssl/openssl/pull/33543). The vendor page lists 4.1.1, 4.0.4 and 3.5.10 as the fixed releases for this flaw (openssl-library.org). I did not open the GitHub releases page, so the publication of these releases is not confirmed here.
  • CVE-2026-107496: the vendor page cites the fix commits and lists 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk and 1.0.2zt as the fixed versions (openssl-library.org). I did not open the commit pages, so the pull request for this fix is not identified.
  • AES-GCM-SIV flaws: the advisory and article do not name the release that carries these fixes beyond the scheduled December 1 date (securityonline.info).

Remediação

  • Plan to upgrade to 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt once they are published, since the official releases are scheduled for December 1, 2026 (securityonline.info, openssl-library.org).
  • Prioritize hosts running OpenSSL QUIC clients that connect to untrusted servers, and services that run CMS_encrypt() with recipient certificates that are not trusted.
  • Check whether any application calls AES-GCM-SIV with a non-12-byte IV length, since only those callers are affected by the vendor's description.

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 11:23 · coletado 10/11 13:02 primeiro registro só resumo do feed

    OpenSSL November 2026 advisory fixes five Low-severity flaws in QUIC, AES-GCM-SIV and CMS

    ler a análise desta fonte

    The OpenSSL Project published its November 2026 security advisory on November 10, 2026 (securityonline.info), covering five flaws that all carry a Low severity rating: two in the QUIC stack, two in the AES-GCM-SIV modes and one infinite loop in CMS encryption. The vendor's own rating is Low for each, and the article's framing matches it: none of the five is a remote code execution bug, and the FIPS modules are not affected (openssl-library.org). The most relevant issue is CVE-2026-95691, a heap use-after-free read in the QUIC client that a malicious QUIC server can trigger, with a crash or one-byte heap disclosure as the outcome (openssl-library.org). CVE-2026-107496 makes CMS_encrypt() loop forever when the recipient's EC certificate declares a group order of 1, so an attacker must supply the recipient certificate (openssl-library.org). The CVE identifiers of the two AES-GCM-SIV flaws are not given in the article or in the vendor pages reviewed. Fixed releases are scheduled for December 1, 2026, while the fixes already sit in the public OpenSSL GitHub repository (securityonline.info).

    Technical Details

    • CVE-2026-95691 (QUIC client, Low): a retransmitted CRYPTO frame that overlaps an existing frame can release the buffer that the TLS record layer still points to, which leads to a use-after-free read during handshake processing (openssl-library.org). Found by Filipe Casal (Trail of Bits). Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4 and 3.5.0 before 3.5.10 (openssl-library.org).
    • CVE-2026-107496 (CMS, Low): a recipient EC certificate with a group order of 1 makes CMS_encrypt() or CMS_encrypt_ex() loop indefinitely, consuming CPU and causing denial of service (openssl-library.org). Reported by Yinxi Liu, fix developed by Jakub Zelenka. Affected: 4.1.0 before 4.1.1, 4.0.0 before 4.0.4, 3.5.0 before 3.5.10, 3.0.0 before 3.0.24, 1.1.1 before 1.1.1zk and 1.0.2 before 1.0.2zt (openssl-library.org). The vendor states the OpenSSL TLS and QUIC implementations do not use this path (openssl-library.org).
    • AES-GCM-SIV flaws (Low): the article names an AAD forgery after a zero-length incremental AAD update and an out-of-bounds read with incorrect IV length handling. The vendor page says only applications calling EVP_CipherInit_ex() (or the provider equivalent) with an IV length other than 12 bytes for AES-GCM-SIV are affected (openssl-library.org). No OpenSSL-implemented protocol uses AES-GCM-SIV (openssl-library.org).
    • Per the article, OpenSSL 4.1, 4.0 and 3.5 are affected by all five flaws, while 3.0, 1.1.1 and 1.0.2 are affected only by CVE-2026-107496 (securityonline.info).

    Fix Details

    • CVE-2026-95691: the fix is pull request #33543 (github.com/openssl/openssl/pull/33543), authored by Sashan and co-authored with Filipe Casal (Trail of Bits), who reported the flaw. Reviewers were Tomas Mraz, Andrew Dinh and Eugene Syromiatnikov. It was merged on November 9, 2026 (github.com/openssl/openssl/pull/33543). The change reintroduces a range-locking mechanism so that a stream range read through the peek path is not replaced while the record layer still uses it (github.com/openssl/openssl/pull/33543). The vendor page lists 4.1.1, 4.0.4 and 3.5.10 as the fixed releases for this flaw (openssl-library.org). I did not open the GitHub releases page, so the publication of these releases is not confirmed here.
    • CVE-2026-107496: the vendor page cites the fix commits and lists 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk and 1.0.2zt as the fixed versions (openssl-library.org). I did not open the commit pages, so the pull request for this fix is not identified.
    • AES-GCM-SIV flaws: the advisory and article do not name the release that carries these fixes beyond the scheduled December 1 date (securityonline.info).

    Remediation

    • Plan to upgrade to 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt once they are published, since the official releases are scheduled for December 1, 2026 (securityonline.info, openssl-library.org).
    • Prioritize hosts running OpenSSL QUIC clients that connect to untrusted servers, and services that run CMS_encrypt() with recipient certificates that are not trusted.
    • Check whether any application calls AES-GCM-SIV with a non-12-byte IV length, since only those callers are affected by the vendor's description.