OPENSUSE-SU-2026:22102-1
Vulnerability from csaf_opensuse - Published: 2026-10-14 15:02 - Updated: 2026-10-19 17:25Summary
Security update for openssl-3
Severity
Important
Notes
Title of the patch: Security update for openssl-3
Description of the patch: This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
Patchnames: openSUSE-Leap-16.0-1916
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
19 products, the same list as for
CVE-2026-35189
Threats
Impact
moderate
References
47 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for openssl-3",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for openssl-3 fixes the following issues:\n\n- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).\n- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).\n- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).\n- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).\n- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).\n- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).\n- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).\n- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).\n- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).\n- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).\n- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1916",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22102-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1280587",
"url": "https://bugzilla.suse.com/1280587"
},
{
"category": "self",
"summary": "SUSE Bug 1280589",
"url": "https://bugzilla.suse.com/1280589"
},
{
"category": "self",
"summary": "SUSE Bug 1280590",
"url": "https://bugzilla.suse.com/1280590"
},
{
"category": "self",
"summary": "SUSE Bug 1280591",
"url": "https://bugzilla.suse.com/1280591"
},
{
"category": "self",
"summary": "SUSE Bug 1280592",
"url": "https://bugzilla.suse.com/1280592"
},
{
"category": "self",
"summary": "SUSE Bug 1280594",
"url": "https://bugzilla.suse.com/1280594"
},
{
"category": "self",
"summary": "SUSE Bug 1280595",
"url": "https://bugzilla.suse.com/1280595"
},
{
"category": "self",
"summary": "SUSE Bug 1280596",
"url": "https://bugzilla.suse.com/1280596"
},
{
"category": "self",
"summary": "SUSE Bug 1280597",
"url": "https://bugzilla.suse.com/1280597"
},
{
"category": "self",
"summary": "SUSE Bug 1280598",
"url": "https://bugzilla.suse.com/1280598"
},
{
"category": "self",
"summary": "SUSE Bug 1280599",
"url": "https://bugzilla.suse.com/1280599"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-35189 page",
"url": "https://www.suse.com/security/cve/CVE-2026-35189/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-35191 page",
"url": "https://www.suse.com/security/cve/CVE-2026-35191/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54872 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54872/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54875 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54875/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-72897 page",
"url": "https://www.suse.com/security/cve/CVE-2026-72897/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-75804 page",
"url": "https://www.suse.com/security/cve/CVE-2026-75804/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-75805 page",
"url": "https://www.suse.com/security/cve/CVE-2026-75805/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-75806 page",
"url": "https://www.suse.com/security/cve/CVE-2026-75806/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-77696 page",
"url": "https://www.suse.com/security/cve/CVE-2026-77696/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84782 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84782/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84784 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84784/"
}
],
"title": "Security update for openssl-3",
"tracking": {
"current_release_date": "2026-10-19T17:25:28Z",
"generator": {
"date": "2026-10-14T15:02:40Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:22102-1",
"initial_release_date": "2026-10-14T15:02:40Z",
"revision_history": [
{
"date": "2026-10-14T15:02:40Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-19T17:25:28Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"product": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"product_id": "libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-devel@3.5.0-160000.11.1?arch=aarch64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"product": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"product_id": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-fips-provider@3.5.0-160000.11.1?arch=aarch64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl3-0:3.5.0-160000.11.1.aarch64",
"product": {
"name": "libopenssl3-0:3.5.0-160000.11.1.aarch64",
"product_id": "libopenssl3-0:3.5.0-160000.11.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl3@3.5.0-160000.11.1?arch=aarch64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "openssl-3-0:3.5.0-160000.11.1.aarch64",
"product": {
"name": "openssl-3-0:3.5.0-160000.11.1.aarch64",
"product_id": "openssl-3-0:3.5.0-160000.11.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/openssl-3@3.5.0-160000.11.1?arch=aarch64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "openssl-3-doc-0:3.5.0-160000.11.1.noarch",
"product": {
"name": "openssl-3-doc-0:3.5.0-160000.11.1.noarch",
"product_id": "openssl-3-doc-0:3.5.0-160000.11.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/openssl-3-doc@3.5.0-160000.11.1?arch=noarch\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"product": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"product_id": "libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-devel@3.5.0-160000.11.1?arch=ppc64le\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"product": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"product_id": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-fips-provider@3.5.0-160000.11.1?arch=ppc64le\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"product": {
"name": "libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"product_id": "libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl3@3.5.0-160000.11.1?arch=ppc64le\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "openssl-3-0:3.5.0-160000.11.1.ppc64le",
"product": {
"name": "openssl-3-0:3.5.0-160000.11.1.ppc64le",
"product_id": "openssl-3-0:3.5.0-160000.11.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/openssl-3@3.5.0-160000.11.1?arch=ppc64le\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"product": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"product_id": "libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-devel@3.5.0-160000.11.1?arch=s390x\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"product": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"product_id": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-fips-provider@3.5.0-160000.11.1?arch=s390x\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl3-0:3.5.0-160000.11.1.s390x",
"product": {
"name": "libopenssl3-0:3.5.0-160000.11.1.s390x",
"product_id": "libopenssl3-0:3.5.0-160000.11.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl3@3.5.0-160000.11.1?arch=s390x\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "openssl-3-0:3.5.0-160000.11.1.s390x",
"product": {
"name": "openssl-3-0:3.5.0-160000.11.1.s390x",
"product_id": "openssl-3-0:3.5.0-160000.11.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/openssl-3@3.5.0-160000.11.1?arch=s390x\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"product": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"product_id": "libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-devel@3.5.0-160000.11.1?arch=x86_64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"product": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"product_id": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-fips-provider@3.5.0-160000.11.1?arch=x86_64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"product": {
"name": "libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"product_id": "libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl-3-fips-provider-x86-64-v3@3.5.0-160000.11.1?arch=x86_64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl3-0:3.5.0-160000.11.1.x86_64",
"product": {
"name": "libopenssl3-0:3.5.0-160000.11.1.x86_64",
"product_id": "libopenssl3-0:3.5.0-160000.11.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl3@3.5.0-160000.11.1?arch=x86_64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"product": {
"name": "libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"product_id": "libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libopenssl3-x86-64-v3@3.5.0-160000.11.1?arch=x86_64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "openssl-3-0:3.5.0-160000.11.1.x86_64",
"product": {
"name": "openssl-3-0:3.5.0-160000.11.1.x86_64",
"product_id": "openssl-3-0:3.5.0-160000.11.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:openssl:openssl:3.5.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/openssl-3@3.5.0-160000.11.1?arch=x86_64\u0026upstream=openssl-3-0:3.5.0-160000.11.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64"
},
"product_reference": "libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le"
},
"product_reference": "libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x"
},
"product_reference": "libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64"
},
"product_reference": "libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64"
},
"product_reference": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le"
},
"product_reference": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x"
},
"product_reference": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64"
},
"product_reference": "libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64"
},
"product_reference": "libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl3-0:3.5.0-160000.11.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64"
},
"product_reference": "libopenssl3-0:3.5.0-160000.11.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl3-0:3.5.0-160000.11.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le"
},
"product_reference": "libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl3-0:3.5.0-160000.11.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x"
},
"product_reference": "libopenssl3-0:3.5.0-160000.11.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl3-0:3.5.0-160000.11.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64"
},
"product_reference": "libopenssl3-0:3.5.0-160000.11.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64"
},
"product_reference": "libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-3-0:3.5.0-160000.11.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64"
},
"product_reference": "openssl-3-0:3.5.0-160000.11.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-3-0:3.5.0-160000.11.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le"
},
"product_reference": "openssl-3-0:3.5.0-160000.11.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-3-0:3.5.0-160000.11.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x"
},
"product_reference": "openssl-3-0:3.5.0-160000.11.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-3-0:3.5.0-160000.11.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64"
},
"product_reference": "openssl-3-0:3.5.0-160000.11.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-3-doc-0:3.5.0-160000.11.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
},
"product_reference": "openssl-3-doc-0:3.5.0-160000.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-35189",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-35189"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake. This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-35189",
"url": "https://www.suse.com/security/cve/CVE-2026-35189"
},
{
"category": "external",
"summary": "SUSE Bug 1280589 for CVE-2026-35189",
"url": "https://bugzilla.suse.com/1280589"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-35189"
},
{
"cve": "CVE-2026-35191",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-35191"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL\u0027s QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack. If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-35191",
"url": "https://www.suse.com/security/cve/CVE-2026-35191"
},
{
"category": "external",
"summary": "SUSE Bug 1280590 for CVE-2026-35191",
"url": "https://bugzilla.suse.com/1280590"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-35191"
},
{
"cve": "CVE-2026-54872",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54872"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54872",
"url": "https://www.suse.com/security/cve/CVE-2026-54872"
},
{
"category": "external",
"summary": "SUSE Bug 1280591 for CVE-2026-54872",
"url": "https://bugzilla.suse.com/1280591"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-54872"
},
{
"cve": "CVE-2026-54875",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54875"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54875",
"url": "https://www.suse.com/security/cve/CVE-2026-54875"
},
{
"category": "external",
"summary": "SUSE Bug 1280592 for CVE-2026-54875",
"url": "https://bugzilla.suse.com/1280592"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-54875"
},
{
"cve": "CVE-2026-72897",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-72897"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection\u0027s SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm\u0027s slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer\u0027s signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-72897",
"url": "https://www.suse.com/security/cve/CVE-2026-72897"
},
{
"category": "external",
"summary": "SUSE Bug 1280594 for CVE-2026-72897",
"url": "https://bugzilla.suse.com/1280594"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-72897"
},
{
"cve": "CVE-2026-75804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-75804"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n - the remote peer opens several streams\n - each stream must stay within the stream-level flow control limit\n - there must be no zero-offset byte sent on any of the streams\n (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-75804",
"url": "https://www.suse.com/security/cve/CVE-2026-75804"
},
{
"category": "external",
"summary": "SUSE Bug 1280595 for CVE-2026-75804",
"url": "https://bugzilla.suse.com/1280595"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-75804"
},
{
"cve": "CVE-2026-75805",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-75805"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n\u0027openssl cmp -cmd rr -csr \u003cfile\u003e\u0027 on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-75805",
"url": "https://www.suse.com/security/cve/CVE-2026-75805"
},
{
"category": "external",
"summary": "SUSE Bug 1280596 for CVE-2026-75805",
"url": "https://bugzilla.suse.com/1280596"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-75805"
},
{
"cve": "CVE-2026-75806",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-75806"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-75806",
"url": "https://www.suse.com/security/cve/CVE-2026-75806"
},
{
"category": "external",
"summary": "SUSE Bug 1280597 for CVE-2026-75806",
"url": "https://bugzilla.suse.com/1280597"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-75806"
},
{
"cve": "CVE-2026-77696",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-77696"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-77696",
"url": "https://www.suse.com/security/cve/CVE-2026-77696"
},
{
"category": "external",
"summary": "SUSE Bug 1280598 for CVE-2026-77696",
"url": "https://bugzilla.suse.com/1280598"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-77696"
},
{
"cve": "CVE-2026-84782",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84782"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission\u0027s read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84782",
"url": "https://www.suse.com/security/cve/CVE-2026-84782"
},
{
"category": "external",
"summary": "SUSE Bug 1280587 for CVE-2026-84782",
"url": "https://bugzilla.suse.com/1280587"
},
{
"category": "external",
"summary": "SUSE Bug 1282798 for CVE-2026-84782",
"url": "https://bugzilla.suse.com/1282798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "important"
}
],
"title": "CVE-2026-84782"
},
{
"cve": "CVE-2026-84784",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84784"
}
],
"notes": [
{
"category": "general",
"text": "Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84784",
"url": "https://www.suse.com/security/cve/CVE-2026-84784"
},
{
"category": "external",
"summary": "SUSE Bug 1280599 for CVE-2026-84784",
"url": "https://bugzilla.suse.com/1280599"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-devel-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl-3-fips-provider-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:libopenssl3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:libopenssl3-x86-64-v3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.aarch64",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.ppc64le",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.s390x",
"openSUSE Leap 16.0:openssl-3-0:3.5.0-160000.11.1.x86_64",
"openSUSE Leap 16.0:openssl-3-doc-0:3.5.0-160000.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-14T15:02:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-84784"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.