CVE-2026-22796

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22796", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-01-09T18:54:13.571Z", "datePublished": "2026-01-27T16:01:28.150Z", "dateUpdated": "2026-10-15T01:12:21.460Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "3.6.1", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.5", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.4", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.3.6", "status": "affected", "version": "3.3.0", "versionType": "semver"}, {"lessThan": "3.0.19", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"lessThan": "1.1.1ze", "status": "affected", "version": "1.1.1", "versionType": "custom"}, {"lessThan": "1.0.2zn", "status": "affected", "version": "1.0.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Luigino Camastra (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Bob Beck"}], "datePublic": "2026-01-27T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: A type confusion vulnerability exists in the signature<br>verification of signed PKCS#7 data where an ASN1_TYPE union member is<br>accessed without first validating the type, causing an invalid or NULL<br>pointer dereference when processing malformed PKCS#7 data.<br><br>Impact summary: An application performing signature verification of PKCS#7<br>data or calling directly the PKCS7_digest_from_attributes() function can be<br>caused to dereference an invalid or NULL pointer when reading, resulting in<br>a Denial of Service.<br><br>The function PKCS7_digest_from_attributes() accesses the message digest attribute<br>value without validating its type. When the type is not V_ASN1_OCTET_STRING,<br>this results in accessing invalid memory through the ASN1_TYPE union, causing<br>a crash.<br><br>Exploiting this vulnerability requires an attacker to provide a malformed<br>signed PKCS#7 to an application that verifies it. The impact of the<br>exploit is just a Denial of Service, the PKCS7 API is legacy and applications<br>should be using the CMS API instead. For these reasons the issue was<br>assessed as Low severity.<br><br>The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,<br>as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module<br>boundary.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}], "value": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-01-27T16:01:28.150Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260127.txt"}, {"name": "3.6.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"}, {"name": "3.5.5 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"}, {"name": "3.4.4 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"}, {"name": "3.3.6 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"}, {"name": "3.0.19 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"}], "source": {"discovery": "UNKNOWN"}, "title": "ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T16:27:50.351586Z", "id": "CVE-2026-22796", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T16:28:52.046Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:12:21.460Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:12:21.460Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-22796", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T16:27:50.351586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T16:28:09.717Z"}}], "cna": {"title": "ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Luigino Camastra (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Bob Beck"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Low"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "3.6.1", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.5", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.4", "versionType": "semver"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.6", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.19", "versionType": "semver"}, {"status": "affected", "version": "1.1.1", "lessThan": "1.1.1ze", "versionType": "custom"}, {"status": "affected", "version": "1.0.2", "lessThan": "1.0.2zn", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-27T14:00:00.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20260127.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2", "name": "3.6.1 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4", "name": "3.5.5 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12", "name": "3.4.4 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e", "name": "3.3.6 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49", "name": "3.0.19 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: A type confusion vulnerability exists in the signature<br>verification of signed PKCS#7 data where an ASN1_TYPE union member is<br>accessed without first validating the type, causing an invalid or NULL<br>pointer dereference when processing malformed PKCS#7 data.<br><br>Impact summary: An application performing signature verification of PKCS#7<br>data or calling directly the PKCS7_digest_from_attributes() function can be<br>caused to dereference an invalid or NULL pointer when reading, resulting in<br>a Denial of Service.<br><br>The function PKCS7_digest_from_attributes() accesses the message digest attribute<br>value without validating its type. When the type is not V_ASN1_OCTET_STRING,<br>this results in accessing invalid memory through the ASN1_TYPE union, causing<br>a crash.<br><br>Exploiting this vulnerability requires an attacker to provide a malformed<br>signed PKCS#7 to an application that verifies it. The impact of the<br>exploit is just a Denial of Service, the PKCS7 API is legacy and applications<br>should be using the CMS API instead. For these reasons the issue was<br>assessed as Low severity.<br><br>The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,<br>as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module<br>boundary.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-01-27T16:01:28.150Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22796", "state": "PUBLISHED", "dateUpdated": "2026-10-15T01:12:21.460Z", "dateReserved": "2026-01-09T18:54:13.571Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2026-01-27T16:01:28.150Z", "assignerShortName": "openssl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "3.6.1", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.5", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.4", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.3.6", "status": "affected", "version": "3.3.0", "versionType": "semver"}, {"lessThan": "3.0.19", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"lessThan": "1.1.1ze", "status": "affected", "version": "1.1.1", "versionType": "custom"}, {"lessThan": "1.0.2zn", "status": "affected", "version": "1.0.2", "versionType": "custom"}]}], "source": "openssl-security@openssl.org"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A8EC60C-05EC-4886-8C82-63AEF4BDA8D5", "versionEndExcluding": "1.0.2zn", "versionStartIncluding": "1.0.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "E000B986-6A31-468F-9EA3-B9D16DB16FB2", "versionEndExcluding": "1.1.1ze", "versionStartIncluding": "1.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "C76C5F55-5243-4461-82F5-2FEBFF4D59FA", "versionEndExcluding": "3.0.19", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5292E9E-6B50-409F-9219-7B0A04047AD8", "versionEndExcluding": "3.3.6", "versionStartIncluding": "3.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9D3DCAE-317D-4DFB-93F0-7A235A229619", "versionEndExcluding": "3.4.4", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CAC7CBE-EC03-4089-938A-0CEEB2E09B62", "versionEndExcluding": "3.5.5", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "68352537-5E99-4F4D-B78A-BCF0353A70A5", "versionEndExcluding": "3.6.1", "versionStartIncluding": "3.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}, {"lang": "es", "value": "Resumen del problema: Existe una vulnerabilidad de confusi\u00f3n de tipos en la verificaci\u00f3n de firma de datos PKCS#7 firmados, donde se accede a un miembro de la uni\u00f3n ASN1_TYPE sin validar primero el tipo, causando una desreferencia de puntero inv\u00e1lido o NULL al procesar datos PKCS#7 malformados.\n\nResumen del impacto: Una aplicaci\u00f3n que realiza la verificaci\u00f3n de firma de datos PKCS#7 o que llama directamente a la funci\u00f3n PKCS7_digest_from_attributes() puede ser inducida a desreferenciar un puntero inv\u00e1lido o NULL al leer, resultando en una denegaci\u00f3n de servicio.\n\nLa funci\u00f3n PKCS7_digest_from_attributes() accede al valor del atributo de resumen del mensaje sin validar su tipo. Cuando el tipo no es V_ASN1_OCTET_STRING, esto resulta en el acceso a memoria inv\u00e1lida a trav\u00e9s de la uni\u00f3n ASN1_TYPE, causando un fallo.\n\nExplotar esta vulnerabilidad requiere que un atacante proporcione un PKCS#7 firmado malformado a una aplicaci\u00f3n que lo verifica. El impacto del exploit es solo una denegaci\u00f3n de servicio, la API PKCS7 es heredada y las aplicaciones deber\u00edan usar la API CMS en su lugar. Por estas razones, el problema fue evaluado como de baja severidad.\n\nLos m\u00f3dulos FIPS en 3.5, 3.4, 3.3 y 3.0 no se ven afectados por este problema, ya que la implementaci\u00f3n de an\u00e1lisis de PKCS#7 est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 y 1.0.2 son vulnerables a este problema."}], "id": "CVE-2026-22796", "lastModified": "2026-06-17T10:20:26.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22796", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T16:27:50.351586Z", "version": "2.0.3"}}]}, "published": "2026-01-27T16:16:35.543", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20260127.txt"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification", "id": "2430390", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1287", "details": ["A flaw was found in OpenSSL. This type confusion vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted PKCS#7 data to an application that performs signature verification. The vulnerability occurs because the application accesses an ASN1_TYPE union member without proper type validation, leading to an invalid or NULL pointer dereference and a crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-22796", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "ovmf", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "compat-openssl10", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mingw-openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "compat-openssl11", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "openssl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-01-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22796\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22796"], "statement": "This vulnerability is rated Low for Red Hat products. A type confusion flaw in the legacy PKCS#7 API can lead to a Denial of Service when processing specially crafted PKCS#7 data. Exploitation requires an application to perform signature verification of malformed PKCS#7 data. Red Hat products utilizing the FIPS module are not affected as the PKCS#7 parsing is outside the module boundary.", "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-18T02:09:21.362832+00:00", "value": {"mitigation_remediation": ["Upgrade OpenSSL to a release that incorporates the fix (e.g., 3.6.1 or later).", "If an upgrade cannot be performed immediately, replace all uses of PKCS7_digest_from_attributes() and legacy PKCS#7 parsing with the CMS API, which is the recommended and secure alternative.", "Apply the upstream patch by cherry\u2011selecting the relevant GitHub commits to your local build before upgrading, or merge the merged changes into your release branch.", "Deploy application monitoring to detect sudden crashes and trigger alerts, ensuring any remaining vulnerable instances are identified and remediated."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "OpenSSL libraries on multiple releases\u2014including 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2\u2014are affected. Applications that perform PKCS#7 signature verification or call PKCS7_digest_from_attributes() directly are vulnerable. The FIPS modules in versions 3.5, 3.4, 3.3 and 3.0 are not impacted because the vulnerable parsing code lies outside the FIPS boundary.", "description_and_impact": "A type confusion vulnerability in OpenSSL\u2019s PKCS7_digest_from_attributes() function allows an attacker to cause a crash when the function processes a malformed PKCS#7 object. The code accesses an ASN1_TYPE union member without first validating that the type is V_ASN1_OCTET_STRING. If the type is different, the union points to invalid or NULL memory, leading to an invalid pointer dereference during signature verification, which in turn triggers a denial of service via application termination.", "risk_and_exploitability": "With a CVSS score of 5.3 and an EPSS probability of less than 1\u202f%, this issue is considered low severity and is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to supply a crafted, malformed signed PKCS#7 message to an application that processes it, typically through a remote interface that accepts signed data. Successful exploitation results in a crash, causing a denial of service without compromising confidentiality or integrity. Because the vulnerability is only triggered by specifically crafted input, attackers must have a vector to deliver the forged PKCS#7 data, such as a web service that accepts signed tokens."}}}}, "created": "2026-01-27T20:16:44.066738+00:00", "updated": "2026-04-18T02:15:05.889876+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}