Bug 2456314 (CVE-2026-28390) - CVE-2026-28390 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Summary: CVE-2026-28390 openssl: OpenSSL: Denial of Service due to NULL pointer derefe...
Keywords:
Status: NEW
Alias: CVE-2026-28390
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2456409 2456412 2456413 2456414 2456447 2456448 2456449 2456450 2456452 2456453 2456454 2456456 2456457 2456459 2456460 2456463 2456464 2456468 2456470 2456471 2456472 2456477 2456478 2456479 2456480 2456481 2456410 2456411 2456415 2456416 2456417 2456418 2456419 2456420 2456421 2456422 2456423 2456424 2456425 2456426 2456427 2456428 2456429 2456430 2456431 2456432 2456433 2456434 2456435 2456436 2456437 2456438 2456439 2456440 2456441 2456442 2456443 2456444 2456445 2456446 2456451 2456455 2456458 2456461 2456462 2456465 2456466 2456467 2456469 2456473 2456474 2456475 2456476
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-07 23:01 UTC by OSIDB Bzimport
Modified: 2026-07-18 08:29 UTC (History)
93 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:39163 0 None None None 2026-07-14 10:43:25 UTC
Red Hat Product Errata RHBA-2026:39806 0 None None None 2026-07-15 09:55:29 UTC
Red Hat Product Errata RHBA-2026:39949 0 None None None 2026-07-15 12:08:00 UTC
Red Hat Product Errata RHBA-2026:40857 0 None None None 2026-07-16 08:47:10 UTC
Red Hat Product Errata RHSA-2026:22312 0 None None None 2026-06-01 13:44:04 UTC
Red Hat Product Errata RHSA-2026:22313 0 None None None 2026-06-01 13:13:05 UTC
Red Hat Product Errata RHSA-2026:22314 0 None None None 2026-06-01 13:21:45 UTC
Red Hat Product Errata RHSA-2026:22315 0 None None None 2026-06-01 13:12:51 UTC
Red Hat Product Errata RHSA-2026:35869 0 None None None 2026-07-06 08:43:27 UTC
Red Hat Product Errata RHSA-2026:36217 0 None None None 2026-07-07 13:26:21 UTC
Red Hat Product Errata RHSA-2026:38503 0 None None None 2026-07-13 04:34:46 UTC
Red Hat Product Errata RHSA-2026:38804 0 None None None 2026-07-13 08:22:19 UTC
Red Hat Product Errata RHSA-2026:38805 0 None None None 2026-07-13 08:24:37 UTC
Red Hat Product Errata RHSA-2026:39009 0 None None None 2026-07-13 16:30:15 UTC
Red Hat Product Errata RHSA-2026:39012 0 None None None 2026-07-13 17:27:03 UTC
Red Hat Product Errata RHSA-2026:39297 0 None None None 2026-07-14 20:29:55 UTC

Description OSIDB Bzimport 2026-04-07 23:01:41 UTC 
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.

When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with
RSA-OAEP encryption is processed, the optional parameters field of
RSA-OAEP SourceFunc algorithm identifier is examined without checking
for its presence. This results in a NULL pointer dereference if the field
is missing.

Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
Comment 2 errata-xmlrpc 2026-06-01 13:12:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:22315 https://access.redhat.com/errata/RHSA-2026:22315
Comment 3 errata-xmlrpc 2026-06-01 13:12:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:22313 https://access.redhat.com/errata/RHSA-2026:22313
Comment 4 errata-xmlrpc 2026-06-01 13:21:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:22314 https://access.redhat.com/errata/RHSA-2026:22314
Comment 5 errata-xmlrpc 2026-06-01 13:43:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:22312 https://access.redhat.com/errata/RHSA-2026:22312
Comment 7 errata-xmlrpc 2026-07-06 08:43:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:35869 https://access.redhat.com/errata/RHSA-2026:35869
Comment 8 errata-xmlrpc 2026-07-07 13:26:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:36217 https://access.redhat.com/errata/RHSA-2026:36217
Comment 9 errata-xmlrpc 2026-07-13 04:34:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:38503 https://access.redhat.com/errata/RHSA-2026:38503
Comment 10 errata-xmlrpc 2026-07-13 08:22:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:38804 https://access.redhat.com/errata/RHSA-2026:38804
Comment 11 errata-xmlrpc 2026-07-13 08:24:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:38805 https://access.redhat.com/errata/RHSA-2026:38805
Comment 12 errata-xmlrpc 2026-07-13 16:30:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:39009 https://access.redhat.com/errata/RHSA-2026:39009
Comment 13 errata-xmlrpc 2026-07-13 17:26:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:39012 https://access.redhat.com/errata/RHSA-2026:39012
Comment 14 errata-xmlrpc 2026-07-14 20:29:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:39297 https://access.redhat.com/errata/RHSA-2026:39297
Note You need to log in before you can comment on or make changes to this bug.