OpenSSL fixes five flaws (denial of service, data disclosure, security policy bypass) in 10 November 2026 releases
The OpenSSL project published its security advisory on 10 November 2026, and the CERT-FR advisory CERTFR-2026-AVI-1496 relays it. It covers five CVEs affecting the 1.0.2, 1.1.1, 3.0, 3.5, 4.0 and 4.1 branches, and the article lists denial of service, loss of data confidentiality and security policy bypass as the impacts. The vendor rates all five flaws Low severity, and the vendor entries read for this research mention no exploitation. Each flaw needs a specific setup: CMS encryption to an attacker-supplied EC certificate, a QUIC client connecting to a malicious server, or an application using AES-GCM-SIV in a particular way (openssl-library.org). Urgency is medium: the impact is limited, but OpenSSL is widely embedded, so upgrading to the fixed branches is advisable.
Entenda a falha
A vulnerabilidade
OpenSSL fixed five flaws, all rated Low by the vendor. CVE-2026-107496 is an infinite loop in CMS_encrypt()/CMS_encrypt_ex() when encrypting to an attacker-supplied EC certificate whose group order is 1, exhausting CPU (denial of service). It affects all six branches. CVE-2026-95691 is a use-after-free read in the QUIC client, triggered by a malicious server, causing denial of service or a one-byte disclosure. CVE-2026-88822 leaks uninitialized stack bytes in QUIC peer detection. CVE-2026-88823 allows AAD forgery in AES-GCM-SIV, and CVE-2026-95692 is a heap out-of-bounds read from a short AES-GCM-SIV IV. The last four are scoped by the vendor to 4.1, 4.0 and 3.5. Fixed in 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk and 1.0.2zt.
Como funciona
For CVE-2026-107496, an application encrypts a CMS message to a recipient certificate it received from outside; if that EC certificate has a group order of 1, the encryption routine never finishes and keeps the CPU busy. For CVE-2026-95691, a QUIC client receives a retransmitted CRYPTO frame from the server; handling it frees packet storage that the TLS record layer still points to, and the later read hits freed memory. For CVE-2026-88822, during automated peer detection, uninitialized stack bytes end up in the destination address of outgoing packets, so connections fail and data leaks. For the AES-GCM-SIV flaws, the code mishandles a zero-length incremental AAD update (treated as a reset) and an IV of the wrong length (short is read out of bounds, long is truncated).
Por que é vulnerável
The causes are missing validation and lifetime errors. The CMS code does not handle an EC group of order 1, so a loop never terminates (CWE-835). The QUIC code frees packet storage while the record layer still holds a pointer to it, and peer detection uses stack memory that was never initialized. AES-GCM-SIV wrongly treats an empty AAD update as a reset and does not reject IVs of the wrong length. The articles do not explain why these went unnoticed or detail the code changes in the fixes.
Onde está
The story names CMS_encrypt() and CMS_encrypt_ex() (CVE-2026-107496), the QUIC peer detection and CRYPTO frame handling code, and the AES-GCM-SIV code; it gives no file names or commits.
Como foi descoberta
The articles do not say who found the flaws or how. The OpenSSL project published its security advisory on 10 November 2026, and CERT-FR relayed it as CERTFR-2026-AVI-1496. The vendor entries mention no exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:47.
Detalhes técnicos
- CVE-2026-107496 (CWE-835): encrypting a CMS message to an EC certificate whose group order is 1 can make CMS_encrypt() or CMS_encrypt_ex() loop without end, which exhausts CPU. The attacker must be able to supply the recipient certificate. The vendor lists all six branches for this flaw (openssl-library.org).
- CVE-2026-88822: during QUIC automated peer detection, uninitialized stack bytes can end up in the address used as the destination for outgoing packets, causing connection loss and data disclosure (openssl-library.org).
- CVE-2026-88823: the AES-GCM-SIV code treats a zero-length incremental AAD update as a reset of all AAD supplied so far, which allows AAD forgery when an application feeds its AAD in fragments (openssl-library.org).
- CVE-2026-95691: a retransmitted QUIC CRYPTO frame can free packet storage that the TLS record layer still points to, giving a use-after-free read in the QUIC client. A malicious server can trigger it, causing denial of service or a one-byte disclosure (openssl-library.org).
- CVE-2026-95692: setting an AES-GCM-SIV IV shorter than the expected nonce length can trigger a heap out-of-bounds read, while a longer IV is silently truncated instead of rejected (openssl-library.org).
The article does not give per-CVE severities or prerequisites. The vendor's own entries supply them, as described above.
Remediação
Upgrade OpenSSL to the fixed release of the branch in use: 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk or 1.0.2zt (openssl-library.org). The article refers readers to the vendor bulletin for the patches. Prioritize hosts that run QUIC clients, that encrypt CMS messages to certificates from outside, or that use AES-GCM-SIV.
Relatos divergentes
The article lists the six branches as affected for the advisory as a whole. The vendor page scopes CVE-2026-107496 to all six, but for CVE-2026-88822, CVE-2026-88823, CVE-2026-95691 and CVE-2026-95692 the entries read list only the 4.1, 4.0 and 3.5 branches (openssl-library.org). The vendor's scope prevails. The article gives no severity, while the vendor rates all five Low.