This Red Hat security advisory addresses multiple vulnerabilities in OpenSSL, including CVE-2026-7383 (heap buffer overflow due to signed integer overflow in Unicode output sizing), CVE-2026-9076 (denial of service from heap out-of-bounds read in CMS password-based decryption), CVE-2026-34180 (heap buffer over-read in ASN.1 decoding leading to denial of service or information disclosure), and several others affecting cryptographic processing, memory management, and protocol handling. The advisory covers a broad range of issues such as acceptance of short HMAC keys in PKCS#12 files, forged CMS AuthEnvelopedData messages, unbounded memory growth in QUIC PATH_CHALLENGE handler, NULL pointer dereferences in various decryption routines, Bleichenbacher oracle attacks in CMS decryption, trust-anchor substitution, and incorrect tag processing in AES-GCM-SIV and AES-SIV modes. These vulnerabilities impact Red Hat Enterprise Linux 9 and 10 distributions and have been fixed in updated OpenSSL packages provided by Red Hat.

The vulnerabilities could lead to heap buffer overflows, denial of service conditions, information disclosure, acceptance of forged cryptographic messages, memory exhaustion, NULL pointer dereferences causing crashes, and cryptographic weaknesses that may undermine the security guarantees of SSL/TLS and related protocols. These issues affect the confidentiality, integrity, and availability of systems using vulnerable OpenSSL versions on Red Hat Enterprise Linux 9 and 10. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated OpenSSL packages for Red Hat Enterprise Linux 9 and 10 that address these vulnerabilities. Users should apply the security updates as soon as possible following Red Hat's official guidance at https://access.redhat.com/articles/11258. The advisory indicates that the update is rated as Important and provides fixes for all listed CVEs. No additional mitigation steps are required beyond applying the official patches.