OpenSSL
OpenSSL Security Releases - April 2026
openssl-2026-04 Apr 1, 2026 Source: Vendor
OpenSSL security advisories for April 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-28387
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
16 lines
Showing 1–16 of 16 matching , clear filters
CVE-2026-28387
BR2026-0000-032124
OpenSSL
unclaimed
Issue summary: An uncommon configuration of clients performing DANE TLSA-based
server authentication, when paired with uncommon server DANE TLSA records, may
result in a use-after-free and/or doubl...
Credited as Igor Morgenstern (Aisle Research)
CVE-2026-28388
BR2026-0000-032125
OpenSSL
unclaimed
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
Impact summary: ...
Credited as Igor Morgenstern (Aisle Research)
CVE-2026-28389
BR2026-0000-032126
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Nathan Sportsman (Praetorian)
CVE-2026-28389
BR2026-0000-032127
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Daniel Rhea
CVE-2026-28389
BR2026-0000-032128
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Jaeho Nam (Seoul National University)
CVE-2026-28389
BR2026-0000-032129
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Muhammad Daffa
CVE-2026-28389
BR2026-0000-032130
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Zhanpeng Liu (Tencent Xuanwu Lab)
CVE-2026-28389
BR2026-0000-032131
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Guannan Wang (Tencent Xuanwu Lab)
CVE-2026-28389
BR2026-0000-032132
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Guancheng Li (Tencent Xuanwu Lab)
CVE-2026-28389
BR2026-0000-032133
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Credited as Joshua Rogers (Aisle Research)
CVE-2026-28390
BR2026-0000-032134
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-con...
Credited as Muhammad Daffa
CVE-2026-28390
BR2026-0000-032135
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-con...
Credited as Zhanpeng Liu (Tencent Xuanwu Lab)
CVE-2026-28390
BR2026-0000-032136
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-con...
Credited as Guannan Wang (Tencent Xuanwu Lab)
CVE-2026-28390
BR2026-0000-032137
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-con...
Credited as Guancheng Li (Tencent Xuanwu Lab)
CVE-2026-28390
BR2026-0000-032138
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-con...
Credited as Joshua Rogers (Aisle Research)
CVE-2026-28390
BR2026-0000-032139
OpenSSL
unclaimed
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-con...
Credited as Chanho Kim