Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-75803: OpenSSL on Debian 12 can be exploited remotely
CVE-2026-75803 · published 4 days ago
Summary
The OpenSSL library used in Debian 12 systems may allow an attacker to run code or steal data. This risk has been fixed in several newer releases of the package. Apply the latest OpenSSL update for your Debian system as soon as possible.
What to do
- Update alpine openssl to version 3.5.8-r0.
- Update debian openssl to version 3.5.7-1~deb13u2.
- Update debian openssl to version 3.6.4-1.
- Update canonical openssl to version 3.0.2-0ubuntu1.29.
- Update canonical openssl to version 3.0.13-0ubuntu3.15.
- Update canonical openssl-fips to version 3.0.13-0ubuntu3.15+Fips1.
- Update canonical openssl to version 3.5.5-1ubuntu3.5.
- Update openssl to version 3.3.7-r1.
- Update openssl to version 3.5.8-r0.
- Update openssl to version 3.0.20-1~deb12u2.aikido.8.
- Update rootio-openssl to version 3.0.20-1~deb12u2.aikido.8.
- Update openssl to version 3.0.19-r00078.
- Update rootio-openssl to version 3.0.19-r00078.
- Update debian openssl to version 3.0.22-1~deb12u1.
- Update canonical openssl to version 3.0.2-0ubuntu1.29+Fips1.
- Update openssl to version 3.0.20-1~deb12u2.aikido.9.
- Update rootio-openssl to version 3.0.20-1~deb12u2.aikido.9.
- Update canonical edk2 to version 2024.02-2ubuntu0.10.
- Update canonical edk2 to version 2025.11-3ubuntu7.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openssl | openssl |
< 4.0.2 >= 3.0.0, < 3.0.22 >= 3.4.0, < 3.4.7 >= 3.5.0, < 3.5.8 >= 3.6.0, < 3.6.4 >= 4.0.0, < 4.0.2 |
| Debian:11 | debian | openssl | All versions |
| Debian:12 | debian | openssl |
< 3.0.22-1~deb12u1 Fix: upgrade to 3.0.22-1~deb12u1
|
| Debian:13 | debian | openssl |
< 3.5.7-1~deb13u2 Fix: upgrade to 3.5.7-1~deb13u2
|
| Debian:14 | debian | openssl |
< 3.6.4-1 Fix: upgrade to 3.6.4-1
|
| Ubuntu:Pro:16.04:LTS | canonical | nodejs | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | nodejs | All versions |
| Ubuntu:22.04:LTS | canonical | openssl |
< 3.0.2-0ubuntu1.29 Fix: upgrade to 3.0.2-0ubuntu1.29
|
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | openssl | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | openssl-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | openssl |
< 3.0.2-0ubuntu1.29+Fips1 Fix: upgrade to 3.0.2-0ubuntu1.29+Fips1
|
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | openssl-fips | All versions |
| Ubuntu:24.04:LTS | canonical | edk2 |
< 2024.02-2ubuntu0.10 Fix: upgrade to 2024.02-2ubuntu0.10
|
| Ubuntu:24.04:LTS | canonical | openssl |
< 3.0.13-0ubuntu3.15 Fix: upgrade to 3.0.13-0ubuntu3.15
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | openssl-fips |
< 3.0.13-0ubuntu3.15+Fips1 Fix: upgrade to 3.0.13-0ubuntu3.15+Fips1
|
| Ubuntu:26.04:LTS | canonical | edk2 |
< 2025.11-3ubuntu7.3 Fix: upgrade to 2025.11-3ubuntu7.3
|
| Ubuntu:26.04:LTS | canonical | openssl |
< 3.5.5-1ubuntu3.5 Fix: upgrade to 3.5.5-1ubuntu3.5
|
| Alpine:v3.24 | alpine | openssl |
< 3.5.8-r0 Fix: upgrade to 3.5.8-r0
|
| Alpine:v3.22 | alpine | openssl |
< 3.5.8-r0 Fix: upgrade to 3.5.8-r0
|
| Alpine:v3.23 | alpine | openssl |
< 3.5.8-r0 Fix: upgrade to 3.5.8-r0
|
| Ubuntu:26.04:LTS | canonical | edk2-hwe | All versions |
| Alpine:v3.21 | – | openssl |
>= 3.0.0, < 3.3.7-r1 Fix: upgrade to 3.3.7-r1
|
| Alpine:v3.22 | – | openssl |
>= 3.0.0, < 3.5.8-r0 Fix: upgrade to 3.5.8-r0
|
| Root:Debian:12 | – | openssl |
< 3.0.20-1~deb12u2.aikido.8 < 3.0.20-1~deb12u2.aikido.9 Fix: upgrade to 3.0.20-1~deb12u2.aikido.8
|
| Root:Debian:12 | – | rootio-openssl |
< 3.0.20-1~deb12u2.aikido.8 < 3.0.20-1~deb12u2.aikido.9 Fix: upgrade to 3.0.20-1~deb12u2.aikido.8
|
| Root:Alpine:3.17 | – | openssl |
< 3.0.19-r00078 Fix: upgrade to 3.0.19-r00078
|
| Root:Alpine:3.17 | – | rootio-openssl |
< 3.0.19-r00078 Fix: upgrade to 3.0.19-r00078
|
Original advisory text
CVE-2026-75803 in openssl - Patched by Root
Root has patched CVE-2026-75803 in the openssl package for Root:Debian:12. Multiple fixed versions available.
References
- https://security-tracker.debian.org/tracker/CVE-2026-75803 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-75803 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-75803 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-75803 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8865-1 Vendor Advisory
- https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f... Patch
- https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75803... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-75803 Vendor Advisory
- https://openssl-library.org/news/secadv/20260825.txt Vendor Advisory
- https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba... Patch
- https://ubuntu.com/security/notices/USN-8678-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8678-3 Vendor Advisory
- https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e0... Patch
- https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-354Improper Validation of Integrity Check Value
Timeline
Published6 Oct 2026
Updated9 Oct 2026
First seen20 Aug 2026
Sources
DEBIAN-CVE-2026-75803 · OSV
UBUNTU-CVE-2026-75803 · OSV
CVE-2026-75803 · MITRE
CVE-2026-75803 · NVD
ALPINE-CVE-2026-75803 · OSV
CVE-2026-75803 · OSV
Track software like this
Free during beta