Skip to main content

OpenSSL CVE-2026-28387

| EUVDEUVD-2026-19961 HIGH
Use After Free (CWE-416)
2026-04-07 openssl
RCE Denial Of Service Use After Free Memory Corruption OpenSSL
High
Disputed · 8.1 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network-reachable with no auth or user interaction (PR:N/UI:N), but AC:H because it needs an uncommon mixed-usage client config plus attacker-influenced server TLSA records; full memory-corruption impact justifies C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
3.7 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Source Code Evidence Fetched
Jul 24, 2026 - 08:12 vuln.today
Analysis Generated
Jul 24, 2026 - 08:12 vuln.today
CVSS changed
Apr 23, 2026 - 16:12 NVD
8.1 (HIGH)
EUVD ID Assigned
Apr 07, 2026 - 22:16 euvd
EUVD-2026-19961
Patch released
Apr 07, 2026 - 22:16 nvd
Patch available
CVE Published
Apr 07, 2026 - 22:00 cve.org
HIGH 8.1
CVE Published
Apr 07, 2026 - 22:00 nvd
N/A

DescriptionNVD

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

AnalysisAI

Use-after-free and/or double-free in OpenSSL's DANE TLSA certificate-matching code (crypto/x509/x509_vfy.c) affects TLS clients that perform DANE-based server authentication using both the PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages when connecting to a server publishing a TLSA RRset mixing those usage types. Successful exploitation can corrupt memory and potentially lead to arbitrary code execution, though the required client configuration is uncommon and the SSVC technical impact is rated total. This is no public exploit identified at time of analysis, with EPSS at 0.02% and SSVC exploitation status 'none', indicating a theoretical rather than actively-exploited threat.

Technical ContextAI

The flaw lives in OpenSSL's X.509 verification path, specifically the DANE (DNS-based Authentication of Named Entities, RFC 6698/7671) TLSA record matching in dane_match_cert(). DANE lets a server publish TLSA records in DNSSEC-signed DNS to bind its certificate or CA to its name, using certificate usages 0 (PKIX-TA), 1 (PKIX-EE), 2 (DANE-TA), and 3 (DANE-EE). The root cause is CWE-416 (Use After Free): the matched certificate stored in dane->mcert was released with the raw allocator OPENSSL_free() instead of the reference-counted X509_free(). Because X509 objects are reference-counted, freeing the underlying memory directly rather than decrementing the reference count leaves dangling references, producing a use-after-free and/or double-free when both PKIX and DANE-TA records participate in matching. The fix (commit 258a8f63) replaces OPENSSL_free(dane->mcert) with X509_free(dane->mcert). Per the CPE cpe:2.3:a:openssl:openssl, only the OpenSSL library is affected; FIPS modules are not, as the code sits outside the FIPS boundary.

RemediationAI

Vendor-released patch: upgrade to OpenSSL 1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, or 3.6.2 (or later) matching your branch, per the OpenSSL advisory at https://openssl-library.org/news/secadv/20260407.txt; the code fix is commit 258a8f63b26995ba357f4326da00e19e29c6acbe (with related commits 444958de, 07e727d3, 7a4e08ce, and ec03fa05). Distribution users should apply Ubuntu USN-8155-1 (https://ubuntu.com/security/notices/USN-8155-1), Red Hat RHSA-2026:7261 (https://access.redhat.com/errata/RHSA-2026:7261), or the relevant SUSE updates (https://www.suse.com/support/update/SUSE-SU-2026:1213/ and siblings 1214-1216, 1255). If patching must be deferred, a specific compensating control is to reconfigure DANE-validating clients to not honor the DANE-TA(2) usage alongside the PKIX usages - i.e., restrict clients to PKIX usages only, or follow RFC 7672 and treat PKIX-usage TLSA records as unusable as SMTP MTAs do; either removes the vulnerable code path at the cost of narrowing which TLSA record types the client will accept. Because the trigger requires both a specific client configuration and a mixed-usage server TLSA RRset, environments not using custom DANE clients are effectively already mitigated by configuration.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2017-3730 HIGH POC
7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container private-registry/1.2/harbor-portal:1.2.0-1.8 Container private-registry/harbor-portal:1.1.2-2.17 Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.3.6.18.1 Affected
Container suse/manager/4.3/proxy-httpd:4.3.17.9.76.9 Container suse/manager/4.3/proxy-squid:4.3.17.9.75.7 Container suse/manager/4.3/proxy-ssh:4.3.17.9.66.7 Affected
Container suse/manager/4.3/proxy-salt-broker:4.3.17.9.66.9 Container suse/manager/4.3/proxy-tftpd:4.3.17.9.66.8 Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.3.8.18.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.3.8.16.1 Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.3.9.16.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.3.8.16.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.3.9.16.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.3.8.16.1 Affected

Share

CVE-2026-28387 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy