RHSA-2026:98484 - Security Advisory

Topic

An update for openssl is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing (CVE-2026-35189)
• openssl: openssl: Denial of Service via excessive QUIC packet buffer retention (CVE-2026-54873)
• openssl: openssl: Denial of Service via crafted CMP certificate revocation response (CVE-2026-75805)
• openssl: openssl: Denial of Service via inefficient QUIC stream reassembly (CVE-2026-42772)
• openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations (CVE-2026-54872)
• openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control (CVE-2026-75804)
• openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V (CVE-2026-54875)
• openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting (CVE-2026-35191)
• openssl: OpenSSL: Private key recovery via SM2 timing side-channel (CVE-2026-77696)
• openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch (CVE-2026-72897)
• openssl: OpenSSL: Denial of Service via undersized DTLS record (CVE-2026-75806)
• openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog (CVE-2026-84784)

Bug Fix(es) and Enhancement(s):

• [RHEL 9.9] OpenSSL silently uses default provider when `fips.so` is missing on systems in FIPS mode (JIRA:RHEL-239862)
• OpenSSL fails to initialize when automatic initialization happens in threads [RHEL 9] (JIRA:RHEL-256385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

• BZ - 2543242 - CVE-2026-35189 openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing
• BZ - 2543244 - CVE-2026-54873 openssl: openssl: Denial of Service via excessive QUIC packet buffer retention
• BZ - 2543247 - CVE-2026-75805 openssl: openssl: Denial of Service via crafted CMP certificate revocation response
• BZ - 2543249 - CVE-2026-42772 openssl: openssl: Denial of Service via inefficient QUIC stream reassembly
• BZ - 2543250 - CVE-2026-54872 openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations
• BZ - 2543254 - CVE-2026-75804 openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control
• BZ - 2543256 - CVE-2026-54875 openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V
• BZ - 2543257 - CVE-2026-35191 openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting
• BZ - 2543258 - CVE-2026-77696 openssl: OpenSSL: Private key recovery via SM2 timing side-channel
• BZ - 2543259 - CVE-2026-72897 openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch
• BZ - 2543260 - CVE-2026-75806 openssl: OpenSSL: Denial of Service via undersized DTLS record
• BZ - 2543261 - CVE-2026-84784 openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog
• RHEL-239862 - [RHEL 9.9] OpenSSL silently uses default provider when `fips.so` is missing on systems in FIPS mode
• RHEL-256385 - OpenSSL fails to initialize when automatic initialization happens in threads [RHEL 9]

CVEs

• CVE-2026-35189
• CVE-2026-35191
• CVE-2026-42772
• CVE-2026-54872
• CVE-2026-54873
• CVE-2026-54875
• CVE-2026-72897
• CVE-2026-75804
• CVE-2026-75805
• CVE-2026-75806
• CVE-2026-77696
• CVE-2026-84784

References

• https://access.redhat.com/security/updates/classification/#moderate