OpenSSL security release fixes five CVEs across the 1.0.2 to 4.1 branches, mostly rated low severity
On 10 November 2026 OpenSSL published a security advisory covering five CVEs, CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691 and CVE-2026-95692, that affect the 1.0.2, 1.1.1, 3.0, 3.5, 4.0 and 4.1 branches. CERT-FR summarizes the impact as remote denial of service, data confidentiality loss and security policy bypass, but does not map each CVE to one of those impacts. The vendor's vulnerability index rates the three entries I could read (CVE-2026-107496, CVE-2026-88822 and CVE-2026-88823) as Low (openssl-library.org/news/vulnerabilities; github.com/Tom-Joad/PanaControl/issues/59 quoting the vendor index), and the severity of CVE-2026-95691 and CVE-2026-95692 was not visible in the page excerpt. Each flaw needs a specific feature or input, such as CMS encryption to a crafted EC recipient certificate, a QUIC connection, or AES-GCM-SIV use, so the exposure is narrower than the headline suggests. No exploitation in the wild is reported in the sources opened. The OpenSSL secadv text could not be fetched during research.
Entenda a falha
A vulnerabilidade
OpenSSL's 10 November 2026 advisory fixes five CVEs, all in the library and each needing a specific feature. CVE-2026-95691: a malicious QUIC server can trigger a heap use-after-free read in the OpenSSL QUIC client (severity not visible in the sources). CVE-2026-95692: the description was not available, so its impact and prerequisites are unconfirmed. CVE-2026-107496 (Low): an infinite loop in CMS_encrypt()/CMS_encrypt_ex() when the recipient EC certificate declares a group order of 1, which ties up CPU. CVE-2026-88823 (Low): AES-GCM-SIV allows forgery of the additional authenticated data after a zero-length incremental AAD update. CVE-2026-88822 (Low): the QUIC stack uses uninitialized stack bytes for peer address auto-detection on an already-connected socket. Affected: 1.0.2 before 1.0.2zt, 1.1.1 before 1.1.1zk, 3.0 before 3.0.24, 3.5 before 3.5.10, 4.0 before 4.0.4 and 4.1 before 4.1.1. These are also the fixed versions. FIPS modules are stated as not affected for CVE-2026-88823 and CVE-2026-95691.
Como funciona
For CVE-2026-107496, an application encrypts a CMS message to a recipient whose EC certificate has a crafted group order of 1. CMS_encrypt() processes that certificate and the code loops without terminating, burning CPU. For CVE-2026-88823, AES-GCM-SIV receives an incremental AAD update with zero length, and the internal state afterwards lets the authenticated data be forged. For CVE-2026-95691, a QUIC client connects to a malicious server, which sends input that makes the client read heap memory after it was freed. For CVE-2026-88822, a QUIC handshake runs on an already-connected socket, and the peer address auto-detection step reads uninitialized stack bytes instead of a real address. The articles do not give more detail on CVE-2026-95692.
Por que é vulnerável
The sources give only short descriptions, so the causes are as stated by type. CVE-2026-107496 is an infinite loop (CWE-835) caused by not handling a degenerate EC group order of 1. CVE-2026-88823 is classed as CWE-325, a missing cryptographic step, in the zero-length AAD update path of AES-GCM-SIV. CVE-2026-88822 is use of uninitialized stack memory in the QUIC address detection. CVE-2026-95691 is memory used after being freed in the QUIC client. The sources do not explain why these went unnoticed or what each patch changes in detail.
Onde está
The articles name CMS_encrypt() and CMS_encrypt_ex() (CVE-2026-107496), the AES-GCM-SIV implementation (CVE-2026-88823) and the QUIC stack/client (CVE-2026-88822, CVE-2026-95691); git commits exist for 4.1.1, 4.0.4 and 3.5.10, but no file names or commit IDs are given.
Como foi descoberta
According to the vendor's vulnerability index, CVE-2026-107496 was found by Yinxi Liu and fixed by Jakub Zelenka. CVE-2026-88823 was found by Jérémy Jean (ANSSI), Bhargava Shastry and Jonathan Bateman (Rochester Institute of Technology), and fixed by Daniel Kubec. The sources do not say who found the other three or how. OpenSSL published the advisory on 10 November 2026, and CERT-FR issued a matching notice the same day. No exploitation in the wild is reported in the sources.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:48.
Detalhes técnicos
- CVE-2026-107496 (Low): an infinite loop in CMS_encrypt() and CMS_encrypt_ex() when the recipient EC certificate declares a group order of 1, letting whoever supplies that certificate tie up CPU (CWE-835). Found by Yinxi Liu; fix by Jakub Zelenka (openssl-library.org/news/vulnerabilities).
- CVE-2026-88823 (Low): forgery of the additional authenticated data in AES-GCM-SIV after a zero-length incremental AAD update (CWE-325). Found by Jérémy Jean (ANSSI), Bhargava Shastry and Jonathan Bateman (Rochester Institute of Technology); fix by Daniel Kubec. The FIPS modules are stated not to be affected (openssl-library.org/news/vulnerabilities).
- CVE-2026-88822 (Low): in the QUIC stack, when a socket is already connected, peer address auto-detection during the handshake uses uninitialized stack bytes, fixed in 3.5.10 (github.com/Tom-Joad/PanaControl/issues/59, quoting openssl-library.org).
- CVE-2026-95691: a malicious QUIC server can trigger a heap-use-after-free read in the OpenSSL QUIC client; FIPS modules are stated not to be affected (openssl-library.org/news/vulnerabilities).
- CVE-2026-95692: the vendor excerpt opened did not include its description, so its impact and prerequisites are not confirmed here.
Detalhes da correção
The vendor vulnerability index lists fixed releases for every branch: 4.1.1 (from 4.1.0), 4.0.4 (from 4.0.0), 3.5.10 (from 3.5.0), 3.0.24 (from 3.0.0), 1.1.1zk (from 1.1.1) and 1.0.2zt (from 1.0.2), with git commits cited for the 4.1.1, 4.0.4 and 3.5.10 releases (openssl-library.org/news/vulnerabilities). The pull requests and commits themselves were not opened, so no PR number, opening or merge dates are given. The vendor index also names the fix developers of CVE-2026-107496 and CVE-2026-88823. The article's version ranges match these fixed releases.
Remediação
Upgrade to 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt according to the branch in use, and rebuild or update packages that statically link OpenSSL. Prioritise services that process CMS messages from untrusted parties, QUIC endpoints and AES-GCM-SIV use, since those are the stated trigger conditions. Consult the OpenSSL secadv bulletin of 10 November 2026 for the full text, which could not be retrieved during research.
Linha do tempo
-
OpenSSL security release fixes five CVEs across the 1.0.2 to 4.1 branches, mostly rated low severity
ler a análise desta fonte ocultar
On 10 November 2026 OpenSSL published a security advisory covering five CVEs, CVE-2026-107496, CVE-2026-88822, CVE-2026-88823, CVE-2026-95691 and CVE-2026-95692, that affect the 1.0.2, 1.1.1, 3.0, 3.5, 4.0 and 4.1 branches. CERT-FR summarizes the impact as remote denial of service, data confidentiality loss and security policy bypass, but does not map each CVE to one of those impacts. The vendor's vulnerability index rates the three entries I could read (CVE-2026-107496, CVE-2026-88822 and CVE-2026-88823) as Low (openssl-library.org/news/vulnerabilities; github.com/Tom-Joad/PanaControl/issues/59 quoting the vendor index), and the severity of CVE-2026-95691 and CVE-2026-95692 was not visible in the page excerpt. Each flaw needs a specific feature or input, such as CMS encryption to a crafted EC recipient certificate, a QUIC connection, or AES-GCM-SIV use, so the exposure is narrower than the headline suggests. No exploitation in the wild is reported in the sources opened. The OpenSSL secadv text could not be fetched during research.
Technical Details
- CVE-2026-107496 (Low): an infinite loop in CMS_encrypt() and CMS_encrypt_ex() when the recipient EC certificate declares a group order of 1, letting whoever supplies that certificate tie up CPU (CWE-835). Found by Yinxi Liu; fix by Jakub Zelenka (openssl-library.org/news/vulnerabilities).
- CVE-2026-88823 (Low): forgery of the additional authenticated data in AES-GCM-SIV after a zero-length incremental AAD update (CWE-325). Found by Jérémy Jean (ANSSI), Bhargava Shastry and Jonathan Bateman (Rochester Institute of Technology); fix by Daniel Kubec. The FIPS modules are stated not to be affected (openssl-library.org/news/vulnerabilities).
- CVE-2026-88822 (Low): in the QUIC stack, when a socket is already connected, peer address auto-detection during the handshake uses uninitialized stack bytes, fixed in 3.5.10 (github.com/Tom-Joad/PanaControl/issues/59, quoting openssl-library.org).
- CVE-2026-95691: a malicious QUIC server can trigger a heap-use-after-free read in the OpenSSL QUIC client; FIPS modules are stated not to be affected (openssl-library.org/news/vulnerabilities).
- CVE-2026-95692: the vendor excerpt opened did not include its description, so its impact and prerequisites are not confirmed here.
Fix Details
The vendor vulnerability index lists fixed releases for every branch: 4.1.1 (from 4.1.0), 4.0.4 (from 4.0.0), 3.5.10 (from 3.5.0), 3.0.24 (from 3.0.0), 1.1.1zk (from 1.1.1) and 1.0.2zt (from 1.0.2), with git commits cited for the 4.1.1, 4.0.4 and 3.5.10 releases (openssl-library.org/news/vulnerabilities). The pull requests and commits themselves were not opened, so no PR number, opening or merge dates are given. The vendor index also names the fix developers of CVE-2026-107496 and CVE-2026-88823. The article's version ranges match these fixed releases.
Remediation
Upgrade to 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt according to the branch in use, and rebuild or update packages that statically link OpenSSL. Prioritise services that process CMS messages from untrusted parties, QUIC endpoints and AES-GCM-SIV use, since those are the stated trigger conditions. Consult the OpenSSL secadv bulletin of 10 November 2026 for the full text, which could not be retrieved during research.