{"id":"RLSA-2026:98588","summary":"Moderate: openssl security, bug fix, and enhancement update","details":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing (CVE-2026-35189)\n\n* openssl: openssl: Denial of Service via excessive QUIC packet buffer retention (CVE-2026-54873)\n\n* openssl: openssl: Denial of Service via crafted CMP certificate revocation response (CVE-2026-75805)\n\n* openssl: openssl: Denial of Service via inefficient QUIC stream reassembly (CVE-2026-42772)\n\n* openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations (CVE-2026-54872)\n\n* openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control (CVE-2026-75804)\n\n* openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V (CVE-2026-54875)\n\n* openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting (CVE-2026-35191)\n\n* openssl: OpenSSL: Private key recovery via SM2 timing side-channel (CVE-2026-77696)\n\n* openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch (CVE-2026-72897)\n\n* openssl: OpenSSL: Denial of Service via undersized DTLS record (CVE-2026-75806)\n\n* openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog (CVE-2026-84784)\n\nBug Fix(es) and Enhancement(s):\n\n* [Rocky Linux 10.3]OpenSSL silently uses default provider when `fips.so` is missing on systems in FIPS mode (JIRA:Rocky Linux-213740)\n\n* OpenSSL fails to initialize when automatic initialization happens in threads (JIRA:Rocky Linux-252344)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-11-13T12:45:08.352816505Z","published":"2026-11-13T12:06:37.188502Z","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-42772","CVE-2026-54872","CVE-2026-54873","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84784"],"database_specific":{"license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","source_advisory":"RHSA-2026:98588"},"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:98588"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543247"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543254"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543260"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543242"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543249"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543256"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543259"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543257"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543244"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543250"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543261"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543258"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:98588"}],"affected":[{"package":{"name":"openssl-debugsource","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debugsource?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-devel","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-devel?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-perl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-perl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-perl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-perl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-devel","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-devel?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debugsource","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debugsource?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-perl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-perl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-devel","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-devel?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debugsource","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debugsource?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-perl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-perl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debugsource","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debugsource?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-devel","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-devel?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-libs","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-libs?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}},{"package":{"name":"openssl-debuginfo","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/openssl-debuginfo?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.9-1.el10_3"}],"database_specific":{"yum_repository":"BaseOS"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:98588.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}