Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
OpenSSL: Untrusted CMS Data Can Crash Application
published 6 months ago
Summary
Certain applications that use OpenSSL to process encrypted messages from unknown sources may crash, preventing them from authenticating users or performing other essential tasks. This issue affects some versions of OpenSSL, but not the FIPS (Federal Information Processing Standard) modules. To protect your application, ensure you're using a version of OpenSSL that's not affected or update to a version that fixes this issue.
What to do
- Update peacefounder appbundler to version 1.0.1.
- Update juliabinarywrappers openssl_jll to version 3.5.6+0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Julia | juliabinarywrappers | openresty_jll | All versions |
| Julia | peacefounder | appbundler |
>= 1.0.0, < 1.0.1 Fix: upgrade to 1.0.1
|
| Julia | juliabinarywrappers | openssl_jll |
>= 3.5.0+0, < 3.5.6+0 Fix: upgrade to 3.5.6+0
|
Original advisory text
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a...
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier
is examined without checking for its presence. This results in a NULL
pointer dereference if the field is missing.
Applications and services that call `CMS_decrypt()` on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier
is examined without checking for its presence. This results in a NULL
pointer dereference if the field is missing.
Applications and services that call `CMS_decrypt()` on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
References
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html URL
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html URL
- https://github.com/advisories/GHSA-7x88-9hgc-69gf URL
- https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384... URL
- https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c6... URL
- https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa80... URL
- https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be724817... URL
- https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce6... URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-28389 URL
- https://openssl-library.org/news/secadv/20260407.txt URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 Apr 2026
Updated13 Aug 2026
First seen13 Aug 2026
Sources
JLSEC-2026-274 · OSV
Track software like this
Free during beta