Skip to main content

OpenSSL CVE-2026-31790

| EUVDEUVD-2026-19969 HIGH
Improper Check for Unusual or Exceptional Conditions (CWE-754)
2026-04-07 openssl GHSA-vgxx-5xj5-q97x
Information Disclosure OpenSSL
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
HIGH
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Re-analysis Queued
Apr 23, 2026 - 16:12 vuln.today
cvss_changed
EUVD ID Assigned
Apr 07, 2026 - 22:16 euvd
EUVD-2026-19969
Analysis Generated
Apr 07, 2026 - 22:16 vuln.today
Patch released
Apr 07, 2026 - 22:16 nvd
Patch available
CVE Published
Apr 07, 2026 - 22:00 nvd
HIGH 7.5

DescriptionCVE.org

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker.

RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced.

If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext.

As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue.

The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.

AnalysisAI

OpenSSL 3.0.0 through 3.6.1 leaks uninitialized memory contents to remote attackers through flawed RSA key encapsulation (RSASVE). Applications using EVP_PKEY_encapsulate() with attacker-supplied invalid RSA public keys can expose stale process memory containing sensitive data due to improper error handling in RSA_public_encrypt(). The vulnerability requires no authentication (CVSS AV:N/PR:N) but has low exploitation probability (EPSS 0.01%). Vendor patches are available for all affected 3.x branches. No active exploitation confirmed (not in CISA KEV), but multiple GitHub commits provide upstream fixes.

Technical ContextAI

This vulnerability affects OpenSSL's RSA-based Key Encapsulation Mechanism (RSASVE) implementation across all 3.x release branches (3.0, 3.3, 3.4, 3.5, 3.6) including FIPS-validated modules. The root cause (CWE-754: Improper Check for Unusual or Exceptional Conditions) lies in the EVP_PKEY_encapsulate() function's handling of RSA_public_encrypt() return values. The code incorrectly treats any non-zero return as success rather than explicitly checking for the success value, allowing -1 (error) returns to be interpreted as valid. When RSA encryption fails against a malformed public key, the function still reports success to the caller and sets output lengths, causing the application to treat uninitialized buffer contents as valid KEM ciphertext. This implementation flaw bypasses normal error propagation, leaving caller-provided buffers containing stale data from previous process execution exposed to attackers who can supply crafted invalid RSA keys.

RemediationAI

Upgrade to patched OpenSSL versions immediately: 3.0.20 or later for the 3.0 branch, 3.3.7+ for 3.3, 3.4.5+ for 3.4, 3.5.6+ for 3.5, or 3.6.2+ for 3.6 series. Vendor-released patches are available per the security advisory at https://openssl-library.org/news/secadv/20260407.txt with upstream fixes in GitHub commits abd8b2eec7e3f3fda60ecfb68498b246b52af482, 001e01db3e996e13ffc72386fe79d03a6683b5ac, d5f8e71cd0a54e961d0c3b174348f8308486f790, b922e24e5b23ffb9cb9e14cadff23d91e9f7e406, and eed200f58cd8645ed77e46b7e9f764e284df379e. As an immediate workaround for applications that cannot upgrade, call EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() to validate RSA public keys before passing them to EVP_PKEY_encapsulate(). Review application code to ensure all RSA keys from untrusted sources undergo validation before use in cryptographic operations.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2017-3730 HIGH POC
7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH
7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-754 – Improper Check for Unusual or Exceptional Conditions

View all
CVE-2024-4367 HIGH POC
8.8
CVE-2017-11144 HIGH
7.5
CVE-2026-24054 CRITICAL POC
10.0
CVE-2023-37303 CRITICAL POC
9.8
CVE-2017-17085 HIGH POC
7.5
CVE-2020-6385 HIGH POC
8.8
CVE-2023-21102 HIGH POC
7.8
CVE-2021-29607 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/ltss/sle12.5/sles12sp5:8.5.219 Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Affected
Container suse/manager/4.3/proxy-httpd:4.3.17.9.76.9 Container suse/manager/4.3/proxy-squid:4.3.17.9.75.7 Container suse/manager/4.3/proxy-ssh:4.3.17.9.66.7 Affected
Container suse/manager/4.3/proxy-salt-broker:4.3.17.9.66.9 Container suse/manager/4.3/proxy-tftpd:4.3.17.9.66.8 Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.157 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.141 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.155 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.124 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected

Share

CVE-2026-31790 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy