CVE-2026-28387

{"id": "CVE-2026-28387", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28387", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T03:56:07.962224Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "openssl-security@openssl.org", "affectedData": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "3.6.2", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.6", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.5", "versionType": "semver"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.7", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.20", "versionType": "semver"}, {"status": "affected", "version": "1.1.1", "lessThan": "1.1.1zg", "versionType": "custom"}], "defaultStatus": "unaffected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-04-07T22:16:20.700", "references": [{"url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://openssl-library.org/news/secadv/20260407.txt", "tags": ["Vendor Advisory"], "source": "openssl-security@openssl.org"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "openssl-security@openssl.org", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}, {"lang": "es", "value": "Resumen del problema: Una configuraci\u00f3n poco com\u00fan de clientes que realizan autenticaci\u00f3n de servidor basada en DANE TLSA, cuando se combina con registros DANE TLSA de servidor poco comunes, puede resultar en un uso despu\u00e9s de liberaci\u00f3n y/o doble liberaci\u00f3n en el lado del cliente.\n\nResumen del impacto: Un uso despu\u00e9s de liberaci\u00f3n puede tener una variedad de consecuencias potenciales, como la corrupci\u00f3n de datos v\u00e1lidos, fallos o ejecuci\u00f3n de c\u00f3digo arbitrario.\n\nSin embargo, el problema solo afecta a clientes que hacen uso de registros TLSA con ambos usos de certificado PKIX-TA(0/PKIX-EE(1) y el uso de certificado DANE-TA(2).\n\nCon mucho, el despliegue m\u00e1s com\u00fan de DANE es en MTAs SMTP para los cuales RFC7672 recomienda que los clientes traten como 'inutilizables' cualquier registro TLSA que tenga los usos de certificado PKIX. Estos clientes SMTP (u otros similares) no son vulnerables a este problema. Por el contrario, cualquier cliente que soporte solo los usos PKIX e ignore el uso DANE-TA(2) tampoco es vulnerable.\n\nEl cliente tambi\u00e9n necesitar\u00eda estar comunic\u00e1ndose con un servidor que publique un conjunto de registros TLSA (TLSA RRset) con ambos tipos de registros TLSA.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema; el c\u00f3digo del problema est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS."}], "lastModified": "2026-07-24T23:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "656A0540-5825-498E-A7AB-C14976FEE45D", "versionEndExcluding": "1.1.1zg", "versionStartIncluding": "1.1.1"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B28A8143-89A4-4332-A1F8-A65FB5AA829F", "versionEndExcluding": "3.0.20", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF303B21-D9BF-461D-B7B0-A3FE1D557A9F", "versionEndExcluding": "3.3.7", "versionStartIncluding": "3.3.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCCE43D0-8F17-475D-9EE6-842F758A9905", "versionEndExcluding": "3.4.5", "versionStartIncluding": "3.4.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6BC0271-444D-4597-BF05-DC60034EAA49", "versionEndExcluding": "3.5.6", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A9E621D-29D8-418A-BF37-BED333C14507", "versionEndExcluding": "3.6.2", "versionStartIncluding": "3.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "openssl-security@openssl.org"}