Vulnerability-Lookup

RHSA-2026:70734

Vulnerability from csaf_redhat - Published: 2026-09-23 11:45 - Updated: 2026-09-30 06:13

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: openssl3: * openssl3-devel-3.5.8-1.hum1 (aarch64, x86_64) * openssl3-devel-engine-3.5.8-1.hum1 (aarch64, x86_64) * openssl3-libs-3.5.8-1.hum1 (aarch64, x86_64) * openssl3-3.5.8-1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-84783

A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:openssl3-0:3.5.8-1.hum1@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@x86_64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@x86_64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

References

11 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:70734	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-84783	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-84783	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543243	external
https://www.cve.org/CVERecord?id=CVE-2026-84783	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84783	external
https://github.com/openssl/openssl/commit/de97a1a…	external
https://openssl-library.org/news/secadv/20260929.txt	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nopenssl3:\n  * openssl3-devel-3.5.8-1.hum1 (aarch64, x86_64)\n  * openssl3-devel-engine-3.5.8-1.hum1 (aarch64, x86_64)\n  * openssl3-libs-3.5.8-1.hum1 (aarch64, x86_64)\n  * openssl3-3.5.8-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:70734",
        "url": "https://access.redhat.com/errata/RHSA-2026:70734"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84783",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84783"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70734.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-30T06:13:04+00:00",
      "generator": {
        "date": "2026-09-30T06:13:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:70734",
      "initial_release_date": "2026-09-23T11:45:06+00:00",
      "revision_history": [
        {
          "date": "2026-09-23T11:45:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-29T18:10:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-30T06:13:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl3-0:3.5.8-1.hum1@src",
                "product": {
                  "name": "openssl3-0:3.5.8-1.hum1@src",
                  "product_id": "openssl3-0:3.5.8-1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3@3.5.8-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl3-devel-0:3.5.8-1.hum1@aarch64",
                "product": {
                  "name": "openssl3-devel-0:3.5.8-1.hum1@aarch64",
                  "product_id": "openssl3-devel-0:3.5.8-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3-devel@3.5.8-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
                "product": {
                  "name": "openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
                  "product_id": "openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3-devel-engine@3.5.8-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl3-libs-0:3.5.8-1.hum1@aarch64",
                "product": {
                  "name": "openssl3-libs-0:3.5.8-1.hum1@aarch64",
                  "product_id": "openssl3-libs-0:3.5.8-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3-libs@3.5.8-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl3-devel-0:3.5.8-1.hum1@x86_64",
                "product": {
                  "name": "openssl3-devel-0:3.5.8-1.hum1@x86_64",
                  "product_id": "openssl3-devel-0:3.5.8-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3-devel@3.5.8-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
                "product": {
                  "name": "openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
                  "product_id": "openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3-devel-engine@3.5.8-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl3-libs-0:3.5.8-1.hum1@x86_64",
                "product": {
                  "name": "openssl3-libs-0:3.5.8-1.hum1@x86_64",
                  "product_id": "openssl3-libs-0:3.5.8-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssl3-libs@3.5.8-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-0:3.5.8-1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-0:3.5.8-1.hum1@src"
        },
        "product_reference": "openssl3-0:3.5.8-1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-devel-0:3.5.8-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@aarch64"
        },
        "product_reference": "openssl3-devel-0:3.5.8-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-devel-0:3.5.8-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@x86_64"
        },
        "product_reference": "openssl3-devel-0:3.5.8-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-devel-engine-0:3.5.8-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@aarch64"
        },
        "product_reference": "openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-devel-engine-0:3.5.8-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@x86_64"
        },
        "product_reference": "openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-libs-0:3.5.8-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@aarch64"
        },
        "product_reference": "openssl3-libs-0:3.5.8-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl3-libs-0:3.5.8-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@x86_64"
        },
        "product_reference": "openssl3-libs-0:3.5.8-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84783",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T15:41:20.039844+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543243"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: openssl: Denial of Service via race condition in certificate extension caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssl3-0:3.5.8-1.hum1@src",
          "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@aarch64",
          "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@x86_64",
          "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
          "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
          "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@aarch64",
          "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543243",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543243"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84783"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081",
          "url": "https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260929.txt",
          "url": "https://openssl-library.org/news/secadv/20260929.txt"
        }
      ],
      "release_date": "2026-09-29T15:32:24.699000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T11:45:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssl3-0:3.5.8-1.hum1@src",
            "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@aarch64",
            "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@x86_64",
            "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
            "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
            "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@aarch64",
            "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70734"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssl3-0:3.5.8-1.hum1@src",
            "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@aarch64",
            "Red Hat Hardened Images:openssl3-devel-0:3.5.8-1.hum1@x86_64",
            "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@aarch64",
            "Red Hat Hardened Images:openssl3-devel-engine-0:3.5.8-1.hum1@x86_64",
            "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@aarch64",
            "Red Hat Hardened Images:openssl3-libs-0:3.5.8-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: openssl: Denial of Service via race condition in certificate extension caching"
    }
  ]
}

CVE-2026-84783 (GCVE-0-2026-84783)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:32 – Updated: 2026-09-29 16:42

Title

Use-After-Free in X.509 Extension Cache Under Concurrent Use

Summary

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:42 UTC

CWE

CWE-416 - Use After Free

Assigner

openssl mitre root Scorecard

References

2 references

URL	Tags
https://openssl-library.org/news/secadv/20260929.txt	vendor-advisory
https://github.com/openssl/openssl/commit/de97a1a…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.3 (semver)

Date Public

2026-09-29 14:21

Credits

Tim Becker (Xint.io) aydinmercan Bob Beck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-84783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:42:36.722506Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:42:41.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.3",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tim Becker (Xint.io)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "aydinmercan"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bob Beck"
        }
      ],
      "datePublic": "2026-09-29T14:21:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: The first concurrent use of the same X.509 certificate by\u003cbr\u003eseveral threads may cause its cached extension data to be freed while\u003cbr\u003eanother thread is still using it.\u003cbr\u003e\u003cbr\u003eImpact summary: A remote, unauthenticated peer could crash a multi-threaded\u003cbr\u003eTLS client, or a multi-threaded TLS server that requests client\u003cbr\u003ecertificates, if the first certificate chains built to the same trusted CA\u003cbr\u003ecertificate are built by several connections at the same time. This is a\u003cbr\u003euse-after-free read, which is likely to crash the process, resulting in a\u003cbr\u003eDenial of Service.\u003cbr\u003e\u003cbr\u003eCWE: CWE-416: Use After Free\u003cbr\u003e\u003cbr\u003eDescription: OpenSSL caches the decoded values of a certificate\u0027s X.509v3\u003cbr\u003eextensions inside the X509 object the first time they are needed. In\u003cbr\u003eOpenSSL 4.0 this cache is built in two phases: the extension values are\u003cbr\u003ecomputed while holding a read lock on the certificate, and the results are\u003cbr\u003ethen installed into the certificate under a write lock. Because a read lock\u003cbr\u003edoes not exclude other readers, several threads can compute the cache for\u003cbr\u003ethe same certificate at the same time. Each thread that subsequently\u003cbr\u003eacquires the write lock installs its own results and frees the values\u003cbr\u003einstalled by the thread before it, even though that earlier thread has\u003cbr\u003ealready marked the cache as complete and may have returned pointers into it\u003cbr\u003eto its caller. A caller still using those pointers then reads freed memory.\u003cbr\u003e\u003cbr\u003eAny certificate shared between threads is exposed the first time its\u003cbr\u003eextensions are decoded. In TLS the certificates at risk are the trusted CA\u003cbr\u003ecertificates supplied for chain verification, by whatever means, since these\u003cbr\u003eare shared by every connection and their extensions are decoded and cached\u003cbr\u003ethe first time a chain is built to them. Certificates sent by the peer are\u003cbr\u003edecoded separately for each connection and are not shared, so they are not\u003cbr\u003eaffected. In a TLS client verifying server certificates, or a TLS server\u003cbr\u003ethat requests and verifies client certificates, the use-after-free could\u003cbr\u003eonly occur if the first chains built to the same trusted CA are built by\u003cbr\u003eseveral connections at the same time.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eThe FIPS module is not affected as X.509 certificate handling is outside\u003cbr\u003eof the OpenSSL FIPS module boundary.\u003cbr\u003e\u003cbr\u003eOpenSSL 4.0 is vulnerable to this issue.\u003cbr\u003e\u003cbr\u003eOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\u003cbr\u003e\u003cbr\u003eOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\u003cbr\u003e\u003cbr\u003eThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\u003cbr\u003eindependently in a public report on 31 August 2026 by aydinmercan.\u003cbr\u003e\u003cbr\u003eThe fix has been developed by Bob Beck.\u003cbr\u003e\u003cbr\u003e-- cut (non-publishing metadata for internal use) --\u003cbr\u003eReported by: Tim Becker (Xint.io), aydinmercan\u003cbr\u003eFixed by: Bob Beck"
            }
          ],
          "value": "Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate\u0027s X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck"
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:32:24.699Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260929.txt"
        },
        {
          "name": "4.0.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use-After-Free in X.509 Extension Cache Under Concurrent Use",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-84783",
    "datePublished": "2026-09-29T15:32:24.699Z",
    "dateReserved": "2026-09-02T10:14:02.262Z",
    "dateUpdated": "2026-09-29T16:42:41.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:70734

CVE-2026-84783 (GCVE-0-2026-84783)

Tags

Sightings

Nomenclature

Related by attack behaviour