{"advisories":[{"id":"USN-8414-1","source":"usn","title":"OpenSSL vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8414-1"},{"id":"USN-8414-2","source":"usn","title":"OpenSSL vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8414-2"},{"id":"DSA-6335-1","source":"dsa","title":"openssl security update","url":"https://lists.debian.org/debian-security-announce/2026/msg00245.html"},{"id":"DLA-4630-1","source":"dla","title":"openssl security update","url":"https://lists.debian.org/debian-lts-announce/2026/06/msg00019.html"}],"cve":"CVE-2026-9076","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[4.0.0,4.0.1)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.6.0,3.6.3)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.5.0,3.5.7)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.4.0,3.4.6)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.0.0,3.0.21)"}},{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[1.1.1,1.1.1zh)"}},{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[1.0.2,1.0.2zq)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"OpenSSL","source":"cna","vendor":"OpenSSL"},"product":"openssl","vendor":"openssl"}],"created":"2026-06-09T17:45:09.854046+00:00","updated":"2026-06-11T02:30:02.689609+00:00","vendors":["openssl","openssl$PRODUCT$openssl"]},"epss":{"score":0.00973},"mitre":{"cpes":[],"created":"2026-06-09T16:03:16.306000+00:00","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/9xxx/CVE-2026-9076.json","references":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"title":"Out-of-Bounds Read in CMS Password-Based Decryption","updated":"2026-06-10T07:47:51.139000+00:00","vendors":[],"weaknesses":["CWE-125"]},"nvd":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"created":"2026-06-09T17:17:50.997000+00:00","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-9076.json","references":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"title":null,"updated":"2026-07-23T08:10:00.137000+00:00","vendors":["openssl","openssl$PRODUCT$openssl"],"weaknesses":["CWE-125"]},"opencve":{"changes":[{"created":"2026-06-09T16:30:00+00:00","data":[{"details":{"new":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.","old":null},"type":"description"},{"details":{"new":"Out-of-Bounds Read in CMS Password-Based Decryption","old":null},"type":"title"},{"details":{"added":["CWE-125"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/openssl/security/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/security/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/security/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/security/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/security/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"removed":[]},"type":"references"}],"id":"45aeea1f-57d5-4024-ac3e-ed67703e5678"},{"created":"2026-06-09T18:00:00+00:00","data":[{"details":["openssl","openssl$PRODUCT$openssl"],"type":"first_time"},{"details":{"added":["openssl","openssl$PRODUCT$openssl"],"removed":[]},"type":"vendors"}],"id":"2fdda8f8-4fa5-4e66-86e5-324a7ae71711"},{"created":"2026-06-09T20:30:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"928d1796-a6fa-481d-a9fc-5a6604d355d0"},{"created":"2026-06-10T08:15:00+00:00","data":[{"details":{"added":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6"],"removed":[]},"type":"references"}],"id":"ff2a469b-e2da-4cc5-82b3-76f64afe29ee"},{"created":"2026-06-10T08:30:00+00:00","data":[{"details":{"added":[],"removed":["https://github.com/openssl/security/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/security/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/security/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/security/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/security/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6"]},"type":"references"}],"id":"edd6c17e-a9d0-4c8e-a45c-0bdf5f449586"},{"created":"2026-06-10T09:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"116c8ea7-f8c0-4fd1-bc14-a44d047ba1be"},{"created":"2026-06-11T00:15:00+00:00","data":[{"details":{"added":["CWE-131"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-9076","https://www.cve.org/CVERecord?id=CVE-2026-9076"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Low","old":null}}},"type":"metrics"}],"id":"7b0c0b60-fd9f-4478-808c-bd8abc831d42"},{"created":"2026-06-16T06:30:00+00:00","data":[{"details":{"added":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"2d123be3-b6e7-4e7c-b5c8-23818ff708ec"}],"cpes":{"data":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-06-09T00:00:00+00:00","provider":"redhat"},"description":{"data":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"provider":"vulnrichment"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00973},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Low","provider":"redhat"}},"references":{"data":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://nvd.nist.gov/vuln/detail/CVE-2026-9076","https://openssl-library.org/news/secadv/20260609.txt","https://www.cve.org/CVERecord?id=CVE-2026-9076"],"providers":["mitre","nvd","redhat"]},"title":{"data":"Out-of-Bounds Read in CMS Password-Based Decryption","provider":"mitre"},"updated":{"data":"2026-06-16T02:45:58.157000+00:00","provider":"nvd"},"vendors":{"data":["openssl","openssl$PRODUCT$openssl"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-125","CWE-131"],"providers":["mitre","nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-06-09T00:00:00+00:00","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\nThe FIPS modules are not affected by this issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"threat_severity":"Low"},"redhat_repo_path":"2026/CVE-2026-9076.json","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-9076","https://www.cve.org/CVERecord?id=CVE-2026-9076"],"title":"openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption","updated":"2026-06-09T00:00:00+00:00","vendors":[],"weaknesses":["CWE-131"]},"vulnrichment":{"cpes":[],"created":"2026-06-09T16:03:16.306000+00:00","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Out-of-Bounds Read in CMS Password-Based Decryption","updated":"2026-06-09T19:04:03.021000+00:00","vendors":[],"vulnrichment_repo_path":"2026/9xxx/CVE-2026-9076.json","weaknesses":[]}}