Skip to content

Add release metadata for security release 25th of August 2026 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
t8m merged 1 commit into from
Aug 25, 2026
Merged

Add release metadata for security release 25th of August 2026 #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
465 changes: 465 additions & 0 deletions secadv/20260825.txt
View file
Open in desktop

Large diffs are not rendered by default.

145 changes: 145 additions & 0 deletions secjson/CVE-2026-14457.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,145 @@
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.8",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
},
{
"lessThan": "3.4.7",
"status": "affected",
"version": "3.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Filipe Casal (Trail of Bits)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Viktor Dukhovni"
}
],
"datePublic": "2026-08-25T13:36:16+02:00",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)<br>enabled, and only the private key (with no associated certificate) configured locally,<br>a NULL pointer dereference may occur when the remote peer solicits raw public keys and<br>also sends the typically omitted \"signature_algorithms_cert\" TLS extension.<br><br>Impact summary: The impact is limited to a possible Denial of Service as a result of<br>an application abort, no data disclosure or remote command execution are possible.<br><br>CWE: CWE-476: NULL Pointer Dereference<br><br>Description: While a passing comment in sample code in the documentation suggests<br>that key-only RPK configurations are supported, the best-practice RPK configuration<br>is to always configure a corresponding certificate (possibly self-signed or<br>signed by any convenient CA).<br><br>When the private key is configured along with a matching certificate, the<br>\"signature_algorithms_cert\" extension is handled reliably even without the<br>fix, and peer clients or servers that don't support raw public keys may be<br>able to complete a TLS connection by pinning or verifying the corresponding<br>certificate or its public key.<br><br>Deployments that prefer to configure just a private key with no certificate<br>need to upgrade to an updated release as noted below.<br><br>FIPS impact: no<br><br>No FIPS modules are affected by this issue, as the SSL protocol implementation<br>is outside the OpenSSL FIPS module boundary."
}
],
"value": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Low"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260825.txt"
},
{
"name": "4.0.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b"
},
{
"name": "3.6.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1"
},
{
"name": "3.5.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f"
},
{
"name": "3.4.7 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-14457",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
142 changes: 142 additions & 0 deletions secjson/CVE-2026-18798.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,142 @@
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.6.0",
"versionType": "semver"
},
{
"lessThan": "3.5.8",
"status": "affected",
"version": "3.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fuzz0x (ZKSC Institute of Security Research)"
},
{
"lang": "en",
"type": "reporter",
"value": "Emilio Galle"
},
{
"lang": "en",
"type": "reporter",
"value": "Feng Xue (ThreatBoon)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandr Nedvedicky"
}
],
"datePublic": "2026-08-25T13:36:16+02:00",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object<br>when channel creation fails for initial packet.<br><br>Impact summary: Double free leads to heap corruption, which typically results in <br>termination of QUIC server process, leading to Denial of Service. There is so<br>far no evidence that this double free is exploitable for remote code execution,<br>thus it is considered highly improbable.<br><br>CWE: CWE-415: Double Free<br><br>Description: In order to validate initial packet, OpenSSL QUIC stack default<br>packet handler (port_default_packet_handler()) creates a so-called QRX object.<br>If the initial packet validates successfully with QRX object, the default packet<br>handler proceeds to channel (connection object) creation. The QRX object used<br>for packet validation is passed to port_bind_channel(), so it becomes part of<br>the newly created connection. If port_bind_channel() fails, then it also frees<br>the QRX object. Once port_bind_channel() returns, the port_default_packet_handler()<br>detects the failure and proceeds to the error branch, where the same QRX object is<br>freed for the second time.<br><br>The failure in port_bind_channel() function can be induced with a relatively<br>low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet<br>carries DCID (destination connection ID) which is shorter than 8 bytes, then<br>port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()<br>detects that the DCID has invalid length.<br><br>FIPS impact: no<br>The FIPS module is not affected, as the QUIC implementation is outside of<br>the OpenSSL FIPS module boundary."
}
],
"value": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Moderate"
},
"type": "https://openssl-library.org/policies/general/security-policy/"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://openssl-library.org/news/secadv/20260825.txt"
},
{
"name": "4.0.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4"
},
{
"name": "3.6.4 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af"
},
{
"name": "3.5.8 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-18798",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading
Loading