Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSL livepatches could cause crashes or service loss
published 1 month ago
Summary
The OpenSSL 1.1 livepatches used on SUSE systems have two flaws that could let a remote attacker cause the software to crash or stop working. This can disrupt any services that rely on secure connections. Apply the latest SUSE update for openssl-1_1-livepatches as soon as possible to fix the issues.
What to do
- Update suse openssl-1_1-livepatches to version 0.8-150600.11.9.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Live Patching 15 SP6 | suse | openssl-1_1-livepatches |
< 0.8-150600.11.9.1 Fix: upgrade to 0.8-150600.11.9.1
|
Original advisory text
Security update for openssl-1_1-livepatches
This update for openssl-1_1-livepatches fixes the following issues:
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788).
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712, bsc#1271713).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788).
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712, bsc#1271713).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264036-1/ Vendor Advisory
- https://bugzilla.suse.com/1271712 Third Party Advisory
- https://bugzilla.suse.com/1271713 Third Party Advisory
- https://bugzilla.suse.com/1274788 Third Party Advisory
- https://bugzilla.suse.com/1275133 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-63072 URL
Timeline
Published7 Sep 2026
Updated13 Sep 2026
First seen13 Sep 2026
Sources
SUSE-SU-2026:4036-1 · OSV
Track software like this
Free during beta