Bug 2456434

Summary:	CVE-2026-28390 ruby: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [fedora-42]
Product:	[Fedora] Fedora	Reporter:	Vipul Nair <vinair>
Component:	ruby	Assignee:	Jarek Prokop <jprokop>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	42	CC:	jprokop, mtasaka, pvalena, ruby-packagers-sig, vondruch
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["b5e373d5-c5e4-40c1-8c22-a6066dc9d4e6"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-04-08 13:51:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2456314

Description Vipul Nair 2026-04-08 09:36:33 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Jarek Prokop 2026-04-08 13:51:44 UTC

After analysis, we determined that this vulnerability is not exploitable for Ruby:

* Reason: This CVE is for OpenSSL and is misreported on Ruby. The bindings carry the same name, but the CVE do not affect Ruby bindings.

Based on this, we are closing this tracker as Not a Bug.