007bsd

CVEs

Every issue below went through coordinated disclosure: reported to the maintainers first, and published once a fix or advisory was ready. Severity is as rated in each advisory.

10
OpenSSL

OpenSSL CVEs

In CMP, CMS, CRMF, OCSP and QUIC.

Remediation developer on 1: CVE-2026-75805

All disclosures

Every CVE and advisory, newest first. Click a project above to show only its issues.

May 2026Jun 2026Jul 2026Aug 2026Sep 2026GHSA-qv2q-c278-pch5 · Information disclosure in PasskeyEncipherImage via AES-CTR nonce reuse (Low)GHSA-vf33-6r7x-66xx · Division by zero in the binomial kernel after an integer overflow (Low)CVE-2026-40169 · Heap buffer over-write of a single byte in the JSON and YAML encoders (incomplete earlier fix) (Moderate)CVE-2026-45624 · Heap buffer over-read of 24 bytes in the polynomial distort operation (Moderate)CVE-2026-45358 · Off-by-one heap over-read of a single byte in the meta encoder (Moderate)CVE-2026-45359 · Heap buffer over-read in connected components with an invalid keep-top define (Moderate)CVE-2026-46559 · Heap buffer over-write of a single byte in the JP2 encoder (Moderate)CVE-2026-46557 · Stack overflow in the fx operation from a missing depth check (Moderate)CVE-2026-47166 · Heap buffer over-read in the distributed pixel cache server (Moderate)CVE-2026-47165 · Information disclosure in the distributed pixel cache server: no challenge-response authentication (Moderate)CVE-2026-42766 · Possible NULL dereference in password-based CMS decryption (Low)CVE-2026-42767 · NULL pointer dereference in CRMF EncryptedValue decryption (Low)CVE-2026-9076 · Out-of-bounds read in CMS password-based decryption (kek_unwrap_key) (Low)CVE-2026-53465 · Heap buffer over-write in the SF3 encoder when writing a multi-frame image (Moderate)CVE-2026-53464 · Memory leak in the wand option parser when providing invalid arguments (Moderate)CVE-2026-53463 · NULL pointer dereference in the distort operation when passing incorrect arguments (Moderate)CVE-2026-10097 · ML-KEM-1024 AVX2 decapsulation compares only 1536 of 1568 ciphertext bytes; IND-CCA2 break and static private-key recovery (High)GHSA-cvhv-g4rq-3hmw · Memory leak when providing invalid options to the magick CLI (Low)CVE-2026-54876 · Client-side memory leak in OCSP response checking (Low)RUSTSEC-2026-0290 · pqc_kyber: AVX2 backend skips Fujisaki–Okamoto implicit rejection, enabling chosen-ciphertext key recovery (High)RUSTSEC-2026-0288 · cosmian_kyber: AVX2 backend skips Fujisaki–Okamoto implicit rejection, enabling chosen-ciphertext key recovery (High)CVE-2026-63072 · Heap buffer overflow in CMS key unwrapping (Moderate)CVE-2026-63076 · Invalid pointer dereference in CMP server via crafted protectionAlg (Moderate)CVE-2026-84784 · QUIC: Unbounded RETIRE_CONNECTION_ID backlog (Low)CVE-2026-75805 · NULL pointer dereference in CMP client revocation response handling (Low)CVE-2026-75804 · QUIC connection-level flow control not enforced for streams (Low)CVE-2026-54873 · QUIC STREAM fragment metadata DoS (Low)GHSA-7vfm-9mfh-j8p5 · DMTF-2026-0004: libspdm_x509_verify_cert_chain() does not verify CA nameConstraints / pathLenConstraint (Moderate)
LowModerateHighone dot per disclosure, stacked by publication week
PublishedIDIssueComponentSeverity
CVE-2026-84784QUIC: Unbounded RETIRE_CONNECTION_ID backlogOpenSSL / QUICLow
CVE-2026-75805NULL pointer dereference in CMP client revocation response handlingAlso credited as remediation developerOpenSSL / CMPLow
CVE-2026-75804QUIC connection-level flow control not enforced for streamsOpenSSL / QUICLow
CVE-2026-54873QUIC STREAM fragment metadata DoSOpenSSL / QUICLow
GHSA-7vfm-9mfh-j8p5DMTF-2026-0004: libspdm_x509_verify_cert_chain() does not verify CA nameConstraints / pathLenConstraintlibspdm / X.509Moderate
RUSTSEC-2026-0289pqc_kyber is unmaintainedRustSec / pqc_kyberInfo
RUSTSEC-2026-0287cosmian_kyber is unmaintainedRustSec / cosmian_kyberInfo
CVE-2026-63072Heap buffer overflow in CMS key unwrappingOpenSSL / CMSModerate
CVE-2026-63076Invalid pointer dereference in CMP server via crafted protectionAlgOpenSSL / CMPModerate
RUSTSEC-2026-0290pqc_kyber: AVX2 backend skips Fujisaki–Okamoto implicit rejection, enabling chosen-ciphertext key recoveryRustSec / pqc_kyberHigh
RUSTSEC-2026-0288cosmian_kyber: AVX2 backend skips Fujisaki–Okamoto implicit rejection, enabling chosen-ciphertext key recoveryRustSec / cosmian_kyberHigh
CVE-2026-54876Client-side memory leak in OCSP response checkingOpenSSL / OCSPLow
GHSA-cvhv-g4rq-3hmwMemory leak when providing invalid options to the magick CLIImageMagick / CLILow
CVE-2026-10097ML-KEM-1024 AVX2 decapsulation compares only 1536 of 1568 ciphertext bytes; IND-CCA2 break and static private-key recoveryThe ARM64 NEON counterpart, CVE-2026-6330, was found independently by Nicholas Carlini of Anthropic and published the same day.wolfSSL / ML-KEMHigh
CVE-2026-42766Possible NULL dereference in password-based CMS decryptionOpenSSL / CMSLow
CVE-2026-42767NULL pointer dereference in CRMF EncryptedValue decryptionOpenSSL / CRMFLow
CVE-2026-9076Out-of-bounds read in CMS password-based decryption (kek_unwrap_key)OpenSSL / CMSLow
CVE-2026-53465Heap buffer over-write in the SF3 encoder when writing a multi-frame imageImageMagick / EncodersModerate
CVE-2026-53464Memory leak in the wand option parser when providing invalid argumentsImageMagick / CLIModerate
CVE-2026-53463NULL pointer dereference in the distort operation when passing incorrect argumentsImageMagick / DistortModerate
CVE-2026-47166Heap buffer over-read in the distributed pixel cache serverImageMagick / Pixel cacheModerate
CVE-2026-47165Information disclosure in the distributed pixel cache server: no challenge-response authenticationImageMagick / Pixel cacheModerate
CVE-2026-46559Heap buffer over-write of a single byte in the JP2 encoderImageMagick / EncodersModerate
CVE-2026-46557Stack overflow in the fx operation from a missing depth checkImageMagick / OperatorsModerate
GHSA-qv2q-c278-pch5Information disclosure in PasskeyEncipherImage via AES-CTR nonce reuseImageMagick / CipherLow
GHSA-vf33-6r7x-66xxDivision by zero in the binomial kernel after an integer overflowImageMagick / OperatorsLow
CVE-2026-40169Heap buffer over-write of a single byte in the JSON and YAML encoders (incomplete earlier fix)ImageMagick / EncodersModerate
CVE-2026-45624Heap buffer over-read of 24 bytes in the polynomial distort operationImageMagick / DistortModerate
CVE-2026-45358Off-by-one heap over-read of a single byte in the meta encoderImageMagick / EncodersModerate
CVE-2026-45359Heap buffer over-read in connected components with an invalid keep-top defineImageMagick / OperatorsModerate

CVE IDs link to their official cve.org records; GHSA and RUSTSEC IDs link to the advisory.

Acknowledged in release notes

Fixes credited to me in release notes and changelogs, without an advisory.

  1. XMSS fixes and LMS bounds checks (PR 11189) wolfSSL 5.9.4
  2. Sniffer reassembly and OCSP stapling CertificateStatus fixes (PR 11211) wolfSSL 5.9.4
  3. Heap write overflow in DescribeImage; bug report and proposed solution GraphicsMagick ChangeLog

Mentions

Advisories, mailing-list posts and articles that cover these issues.

  1. OpenSSL vulnerability list Official OpenSSL advisories, credits and affected versions
  2. GitHub Advisory Database, credit:007bsd All GitHub-published advisories crediting 007bsd
  3. Ubuntu Security Notice USN-8414-1 Ubuntu OpenSSL update for the June advisory
  4. oss-security CVE-2026-54876: client-side memory leak in OCSP response checking
  5. HOL Guard Write-up of CVE-2026-63072
  6. shattered.io (French) Article on the August OpenSSL bulletin; names CVE-2026-63072 and its reporters
  7. Cybersecurity News Article on the August OpenSSL release; covers CVE-2026-63072
  8. GBHackers Article on the August OpenSSL release; covers CVE-2026-63072
  9. Cyberpress Article on the August OpenSSL release; covers CVE-2026-63072
  10. Open Source For You Article on OpenSSL 4.0.2; covers CVE-2026-63072