Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
This update includes the following RPMs: openssl: * openssl-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-config-fips-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-devel-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-devel-engine-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-fips-provider-upstream-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-libs-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-perl-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-3.5.6-0.3.hum1.src (src)
AI Analysis
Technical Summary
CVE-2026-28390 is a denial of service vulnerability in OpenSSL caused by a NULL pointer dereference during CMS EnvelopedData processing. This flaw can cause the OpenSSL library to crash, potentially disrupting services that rely on it. Red Hat has issued a security advisory (RHSA-2026:22312) indicating that an update to OpenSSL is available for Red Hat Enterprise Linux 9 and its variants to remediate this issue. The advisory rates the impact as moderate and references the official Red Hat errata for patch details.
Potential Impact
Successful exploitation of this vulnerability can cause a denial of service by crashing applications using the vulnerable OpenSSL CMS EnvelopedData processing code. This may lead to service interruptions or application instability on affected systems. There are no reports of active exploitation in the wild. The impact is limited to denial of service and does not include code execution or data disclosure based on the available information.
Mitigation Recommendations
Red Hat has released an official security update for OpenSSL in Red Hat Enterprise Linux 9 to address CVE-2026-28390. Users should apply the update as per Red Hat's guidance available at https://access.redhat.com/articles/11258 to remediate this vulnerability. Since this is an official fix, applying the vendor-provided update is the recommended and effective mitigation. No additional mitigations are specified or required.
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
This update includes the following RPMs: openssl: * openssl-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-config-fips-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-devel-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-devel-engine-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-fips-provider-upstream-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-libs-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-perl-3.5.6-0.3.hum1 (aarch64, x86_64) * openssl-3.5.6-0.3.hum1.src (src)
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-28390 is a denial of service vulnerability in OpenSSL caused by a NULL pointer dereference during CMS EnvelopedData processing. This flaw can cause the OpenSSL library to crash, potentially disrupting services that rely on it. Red Hat has issued a security advisory (RHSA-2026:22312) indicating that an update to OpenSSL is available for Red Hat Enterprise Linux 9 and its variants to remediate this issue. The advisory rates the impact as moderate and references the official Red Hat errata for patch details.
Potential Impact
Successful exploitation of this vulnerability can cause a denial of service by crashing applications using the vulnerable OpenSSL CMS EnvelopedData processing code. This may lead to service interruptions or application instability on affected systems. There are no reports of active exploitation in the wild. The impact is limited to denial of service and does not include code execution or data disclosure based on the available information.
Mitigation Recommendations
Red Hat has released an official security update for OpenSSL in Red Hat Enterprise Linux 9 to address CVE-2026-28390. Users should apply the update as per Red Hat's guidance available at https://access.redhat.com/articles/11258 to remediate this vulnerability. Since this is an official fix, applying the vendor-provided update is the recommended and effective mitigation. No additional mitigations are specified or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-28390
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a1ca158e29bf47b505e1e1d
Added to database: 05/31/2026, 21:00:08 UTC
Last enriched: 07/30/2026, 15:15:28 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.