What is the CVSS score of CVE-2026-72897?

CVE-2026-72897 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-72897?

Within 24 hours, identify all systems running affected OpenSSL versions (4.0.0-4.0.2, 3.6.0-3.6.4, 3.5.0-3.5.8, 3.4.0-3.4.7) and assess whether they call SSL_set_SSL_CTX() during an in-progress handshake, particularly in SNI callbacks used for virtual hosting or multi-certificate selection. Within 7 days, apply vendor-released patches by upgrading to OpenSSL 4.0.3, 3.6.5, 3.5.9, or 3.4.8 as appropriate for your version branch, and verify that all TLS/DTLS endpoints have been updated. Within 30 days, conduct a comprehensive audit of all OpenSSL deployments, including embedded and third-party components, ensure no vulnerable versions remain, and implement network monitoring for unusual handshake failures or server crashes to detect potential exploitation attempts.

OpenSSL CVE-2026-72897

Q: Which versions of OpenSSL are affected by CVE-2026-72897?

OpenSSL versions 3.4.x, 3.5.x, 3.6.x, and 4.0.x are affected by a high-severity out-of-bounds memory access flaw that can crash or destabilize TLS/DTLS servers during handshake processing.. A patch is available.

EUVD-2026-89008 HIGH

Out-of-bounds Write (CWE-787)

2026-09-29

GHSA-x8gv-f6w5-h79g

Buffer Overflow Memory Corruption OpenSSL

7.5

CVSS 3.1 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Connect to OpenSSL TLS server
Exploit

Send handshake invoking SNI/SSL_set_SSL_CTX path
Execution

Trigger out-of-bounds access
Impact

Crash process (denial of service)

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the target application to call SSL_set_SSL_CTX() during an in-progress TLS handshake - in practice this is servers that switch SSL_CTX objects inside the SNI (servername) callback for virtual hosting or multi-certificate selection. The attacker needs only network reach to such a server and no authentication or user interaction (PR:N/UI:N), but applications that never invoke SSL_set_SSL_CTX() mid-handshake are not exposed. Impact is limited to denial of service (A:H, C:N/I:N); affected versions are OpenSSL 4.0.0-4.0.2, 3.6.0-3.6.4, 3.5.0-3.5.8, and 3.4.0-3.4.7, fixed respectively in 4.0.3/3.6.5/3.5.9/3.4.8.
Impact	This is a genuine but conditional availability issue rather than a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reports a remotely reachable, unauthenticated flaw with an availability-only impact - despite the CWE-787 (out-of-bounds write) classification and the 'Buffer Overflow'/'Memory Corruption' tags, C:N and I:N mean no confidentiality or code-execution impact is claimed, so the realistic outcome is a server crash/DoS. No EPSS score, no CISA KEV listing, and no POC are present in the input, so there is no evidence of active exploitation or automatable weaponization. The most important nuance the raw CVSS hides: the bug is reached only 'after SSL_set_SSL_CTX() during a handshake', an API path exercised chiefly by servers that switch SSL_CTX objects in the SNI servername callback (virtual-hosting/multi-cert setups). Applications that never call SSL_set_SSL_CTX() mid-handshake are effectively not exposed, which lowers real-world reach below what AC:L/PR:N implies. Net: real fix-worthy DoS in a ubiquitous library, but medium priority given DoS-only impact, no exploitation signals, and an application-configuration-dependent trigger.
Exploit ScenarioDerived	An attacker opens TLS connections to an OpenSSL-based server that selects its certificate/context via the SNI callback (calling SSL_set_SSL_CTX() mid-handshake) and drives the handshake down the affected code path, triggering an out-of-bounds access that crashes or destabilizes the process for denial of service. No authentication or user interaction is required and the vector is network-facing, but no public exploit code or active exploitation is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Out-of-bounds memory access in OpenSSL during an in-progress TLS/DTLS handshake can crash or destabilize servers that call SSL_set_SSL_CTX() mid-handshake, producing a denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). The issue affects OpenSSL 4.0.0 through 4.0.2, 3.6.0 through 3.6.4, 3.5.0 through 3.5.8, and 3.4.0 through 3.4.7, and is fixed in 4.0.3, 3.6.5, 3.5.9, and 3.4.8 respectively. Exploitation is unauthenticated and requires only network reach to a server that swaps SSL_CTX objects inside the SNI (servername) callback for virtual hosting or multi-certificate selection; no public exploit identified at time of analysis, and this is a conditional availability issue rather than a critical priority.

RemediationAI

Vendor-released patch: upgrade to OpenSSL 4.0.3 on the 4.0 branch, 3.6.5 on 3.6, 3.5.9 on 3.5, or 3.4.8 on 3.4 (per https://openssl-library.org/news/secadv/20260929.txt and the release tag https://github.com/openssl/openssl/releases/tag/openssl-4.0.3). Because exploitation is gated on calling SSL_set_SSL_CTX() during an in-progress handshake, the most effective compensating control where an immediate upgrade is not possible is to stop performing context swaps mid-handshake: instead of changing SSL_CTX inside the SNI/servername callback, pre-load the required certificates and keys into a single SSL_CTX (for example via SSL_CTX_use_certificate_chain_file/SSL_CTX_use_PrivateKey or per-context certificate selection configured before the handshake begins), or defer virtual-host selection so the context is fixed before the handshake starts. The trade-off is reduced flexibility for per-host certificate/dhparam configuration and potentially more complex certificate-loading code, and this workaround only removes exposure for applications that can actually be restructured this way; it does not fix the underlying memory bug. Additional hardening that reduces but does not eliminate risk includes restricting network reachability to the affected TLS/DTLS listeners and monitoring for unexpected process aborts or restarts on such endpoints. Note that the upstream commits listed in the advisory references (00646e5085a0d12d29e0d2f9b9bc5f7111a50922, 4135f553c9d3ba4a09fe752f5d30af2a6a092b2e, 9c54d209486f6b1ad79fe2179c40f13200fa4f61, e87ed26b298a74d8ba61a53e9c7bcd1acac6b814) document the fix; the supported path is a version upgrade to one of the released patched versions above.

Affected VersionsENISA

OpenSSL 3.5.0 <3.5.9

OpenSSL 3.4.0 <3.4.8

OpenSSL 3.6.0 <3.6.5

OpenSSL 4.0.0 <4.0.3

Affected Packages

euvd openssl fix: 3.4.8, 3.5.9, 3.6.5, 4.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenSSL's SSL_set_SSL_CTX() allows an application to rebind an active SSL object to a different SSL_CTX, a pattern commonly used inside the servername (SNI) callback to select per-virtual-host certificate configuration during the handshake. CVE-2026-72897 is an out-of-bounds access that occurs when this context swap happens while a handshake is in flight: the handshake state machine continues to operate on buffer/offset state that no longer matches the newly installed context, resulting in an out-of-bounds memory access (classified under CWE-787, out-of-bounds write, with associated buffer-overflow/memory-corruption tags). The assessed consequence is availability-only (A:H, C:N/I:N), consistent with a crash or abort rather than memory disclosure or code execution. The affected code spans the TLS and DTLS handshake paths across the OpenSSL 3.4, 3.5, 3.6, and 4.0 release branches, and the fix is delivered as part of the 4.0.3 security patch release alongside unrelated fixes for DTLS retransmission buffer offsets (CVE-2026-84782), X.509 extension cache use-after-free (CVE-2026-84783), CRLDP memory allocation (CVE-2026-35189), and multiple QUIC flow-control, fragment-reassembly, and amplification-credit issues (CVE-2026-35191, CVE-2026-42772, CVE-2026-54873, CVE-2026-75804, CVE-2026-84784), plus EC/SM2 timing side-channels (CVE-2026-54872, CVE-2026-54875, CVE-2026-77696). Patch references include upstream commits 00646e5085a0d12d29e0d2f9b9bc5f7111a50922, 4135f553c9d3ba4a09fe752f5d30af2a6a092b2e, 9c54d209486f6b1ad79fe2179c40f13200fa4f61, and e87ed26b298a74d8ba61a53e9c7bcd1acac6b814.

Know when OpenSSL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Network-reachable, unauthenticated handshake trigger with no user interaction; out-of-bounds access yields process crash so A:H only, C:N/I:N; app must use SSL_set_SSL_CTX but that is defender-side, so AC:L retained.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat 5.9 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Sep 29, 2026 - 13:53 github-releases

HIGH 7.5

CVE Published

Sep 29, 2026 - 13:53 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Articles & Coverage 2

News 4 New OpenSSL Vulnerabilities - 4 High Severity, No POC Available Sep 30, 2026 News 4 New OpenSSL Vulnerabilities - 4 High Severity, No POC Available Sep 29, 2026

Executive ViewAI

Why It Matters

OpenSSL versions 3.4.x, 3.5.x, 3.6.x, and 4.0.x are affected by a high-severity out-of-bounds memory access flaw that can crash or destabilize TLS/DTLS servers during handshake processing. Unauthenticated remote attackers with network access to a server configured to swap SSL_CTX objects within the SNI callback-common in virtual hosting or multi-certificate environments-can trigger a denial of service. While no public exploit identified at time of analysis, organizations relying on affected OpenSSL versions for critical TLS termination should prioritize patching to maintain service availability.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 83% exploitable

Prevalence

Ubiquitous

OpenSSL is the de facto TLS/crypto library across servers, appliances, and OS distributions

Data Quality

8 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2021-3711 CRITICAL Act Now POC

9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2015-4000 LOW Monitor POC

3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/bci-sle15-kernel-module-devel:15.7-61.25 Container bci/openjdk-devel:17.0.20.1-21.71 Container bci/openjdk-devel:21.0.12.1-25.71 Container bci/openjdk-devel:25.0.4.1-9.72 Container bci/openjdk:17.0.20.1-20.61 Container bci/openjdk:21.0.12.1-24.60 Container bci/openjdk:25.0.4.1-9.60 Container bci/python:3.13.15-88.58 Container bci/python:3.6.15-84.56 Container suse/sle15:15.7-5.23.43	Affected
Container private-registry/1.2/harbor-core:1.2.1-1.115 Container private-registry/1.2/harbor-exporter:1.2.1-1.115 Container private-registry/1.2/harbor-jobservice:1.2.1-1.113 Container private-registry/1.2/harbor-registry:1.2.1-1.115 Container private-registry/1.2/harbor-registryctl:1.2.1-1.115 Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.124 Container private-registry/harbor-core:latest Container private-registry/harbor-exporter:latest Container private-registry/harbor-jobservice:latest Container private-registry/harbor-registry:2.8.3-1.85 Container private-registry/harbor-registryctl:latest Container private-registry/harbor-trivy-adapter:0.35.1-1.87 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.177 Container suse/kiosk/tigervnc-x11vnc:1.14-63.43 Container suse/mariadb:11.8.8-79.42 Image pr_15_7_1_0	Affected
Container private-registry/1.2/harbor-portal:1.2.1-1.124 Container private-registry/harbor-portal:latest Container suse/kea:2.6-80.9 Container suse/kiosk/firefox-esr:153.3-75.45 Container suse/kiosk/pulseaudio:17.0-73.42 Container suse/kiosk/xorg-client:21-81.7 Container suse/kiosk/xorg:21.1-83.42 Container suse/mariadb-client:11.8.8-72.32 Container suse/postgres:16.15-93.41 Container suse/postgres:16.15-contrib-93.41 Container suse/postgres:17.11-83.40 Container suse/postgres:17.11-contrib-83.40 Container suse/postgres:18.6-73.40 Container suse/rmt-server:3.1-72.2 Container suse/samba-client:4.21-75.34 Container suse/samba-server:4.21-76.36 Container suse/samba-toolbox:4.21-76.34 Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4 Container third-party/amd/amdgpu-driver:sles-15.7-31.10 Container third-party/amd/amdgpu-driver:sles-15.7-31.20 Container third-party/amd/amdgpu-driver:sles-15.7-31.30 Container third-party/amd/amdgpu-driver:sles-15.7-31.40.1 Container third-party/amd/amdgpu-driver:sles-15.7-31.50 Container third-party/nvidia/driver:550-sles15.7 Container third-party/nvidia/driver:570-sles15.7 Container third-party/nvidia/driver:575-sles15.7 Container third-party/nvidia/driver:580-sles15.7 Container third-party/nvidia/driver:590-sles15.7 Container third-party/nvidia/driver:595-sles15.7 Container third-party/nvidia/driver:610-sles15.7 Container third-party/nvidia/driver:615-sles15.7	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Not-Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:74162 ADVISORY https://access.redhat.com/errata/RHSA-2026:74166 ADVISORY https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-72897 ADVISORY https://seclists.org/oss-sec/2026/q3/1001 ADVISORY https://ubuntu.com/security/notices/USN-8847-1 ADVISORY https://vuldb.com/vuln/411432 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4414/ REF https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922 REF https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e REF https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61 REF https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814 REF https://openssl-library.org/news/secadv/20260929.txt

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back