Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSL on AlmaLinux can allow remote memory crash
published 1 month ago
Summary
The OpenSSL libraries shipped with AlmaLinux may let a remote attacker cause the system to run out of memory or write beyond expected limits, potentially crashing services. This happens when specially crafted network traffic or encrypted files are processed. Update the OpenSSL packages on AlmaLinux to the latest version to apply the fix.
What to do
- Update almalinux openssl to version 1:3.0.7-20.el9_2.tuxcare.1.els22.
- Update almalinux openssl-devel to version 1:3.0.7-20.el9_2.tuxcare.1.els22.
- Update almalinux openssl-libs to version 1:3.0.7-20.el9_2.tuxcare.1.els22.
- Update almalinux openssl-perl to version 1:3.0.7-20.el9_2.tuxcare.1.els22.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | openssl |
< 1:3.0.7-20.el9_2.tuxcare.1.els22 Fix: upgrade to 1:3.0.7-20.el9_2.tuxcare.1.els22
|
| TuxCare:AlmaLinux:9.2 | almalinux | openssl-devel |
< 1:3.0.7-20.el9_2.tuxcare.1.els22 Fix: upgrade to 1:3.0.7-20.el9_2.tuxcare.1.els22
|
| TuxCare:AlmaLinux:9.2 | almalinux | openssl-libs |
< 1:3.0.7-20.el9_2.tuxcare.1.els22 Fix: upgrade to 1:3.0.7-20.el9_2.tuxcare.1.els22
|
| TuxCare:AlmaLinux:9.2 | almalinux | openssl-perl |
< 1:3.0.7-20.el9_2.tuxcare.1.els22 Fix: upgrade to 1:3.0.7-20.el9_2.tuxcare.1.els22
|
Original advisory text
openssl: Fix of 2 CVEs
- CVE-2026-54874: buffer only a DTLS record's own bytes instead of the whole
read buffer, and lower the unprocessed records queue limit, to avoid remote
memory exhaustion
- CVE-2026-63072: size the CMS key-unwrap output buffer for the AES-WRAP-PAD
worst case to prevent an 8-byte out-of-bounds heap write in CMS_decrypt()
read buffer, and lower the unprocessed records queue limit, to avoid remote
memory exhaustion
- CVE-2026-63072: size the CMS key-unwrap output buffer for the AES-WRAP-PAD
worst case to prevent an 8-byte out-of-bounds heap write in CMS_decrypt()
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789551334.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54874 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63072 Vendor Advisory
Timeline
Published16 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789551334 · OSV
Track software like this
Free during beta