{"schema_version":"2","view":"grouped","data":[{"id":70966,"cve_ids":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592). - CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594). - CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587). - CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599). Other non-security fixes: - Add a conflicts with previous crypto-policies versions (bsc#1281125)","evidence":"osv:SUSE-SU-2026:4414-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-150700.5.53.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4414-1","aliases":["SUSE-SU-2026:4414-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150700.5.53.2"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4414-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.5.0-150700.5.53.2","libopenssl3":"3.5.0-150700.5.53.2","libopenssl3-32bit":"3.5.0-150700.5.53.2","libopenssl-3-devel":"3.5.0-150700.5.53.2","libopenssl-3-fips-provider":"3.5.0-150700.5.53.2","libopenssl-3-fips-provider-32bit":"3.5.0-150700.5.53.2"}]}}],"modified":"2026-10-02T18:30:38.511993727Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264414-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280590","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280592","https://bugzilla.suse.com/1280594","https://bugzilla.suse.com/1280595","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://bugzilla.suse.com/1280599","https://bugzilla.suse.com/1281125","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-35191","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-54875","https://www.suse.com/security/cve/CVE-2026-72897","https://www.suse.com/security/cve/CVE-2026-75804","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782","https://www.suse.com/security/cve/CVE-2026-84784"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-35191","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-54875","evidence":"/upstream"},{"value":"CVE-2026-72897","evidence":"/upstream"},{"value":"CVE-2026-75804","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"},{"value":"CVE-2026-84784","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:258c8e67-9fd0-411d-bcd5-27a3ca08de5d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4414-1","advisory_id":"258c8e67-9fd0-411d-bcd5-27a3ca08de5d","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.107879+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:37:31+00:00","detail_url":"/advisories/advisory%3A258c8e67-9fd0-411d-bcd5-27a3ca08de5d","group":{"id":"advisory:258c8e67-9fd0-411d-bcd5-27a3ca08de5d","revision":1,"primary_event_id":71339,"change":"published","superseded_by":[],"changed":{"id":71339,"cve_ids":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592). - CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594). - CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587). - CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599). Other non-security fixes: - Add a conflicts with previous crypto-policies versions (bsc#1281125)","evidence":"osv:SUSE-SU-2026:4414-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-150700.5.53.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4414-1","aliases":["SUSE-SU-2026:4414-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150700.5.53.2"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4414-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.5.0-150700.5.53.2","libopenssl3":"3.5.0-150700.5.53.2","libopenssl3-32bit":"3.5.0-150700.5.53.2","libopenssl-3-devel":"3.5.0-150700.5.53.2","libopenssl-3-fips-provider":"3.5.0-150700.5.53.2","libopenssl-3-fips-provider-32bit":"3.5.0-150700.5.53.2"}]}}],"modified":"2026-10-02T18:30:38.511993727Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264414-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280590","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280592","https://bugzilla.suse.com/1280594","https://bugzilla.suse.com/1280595","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://bugzilla.suse.com/1280599","https://bugzilla.suse.com/1281125","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-35191","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-54875","https://www.suse.com/security/cve/CVE-2026-72897","https://www.suse.com/security/cve/CVE-2026-75804","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782","https://www.suse.com/security/cve/CVE-2026-84784"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-35191","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-54875","evidence":"/upstream"},{"value":"CVE-2026-72897","evidence":"/upstream"},{"value":"CVE-2026-75804","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"},{"value":"CVE-2026-84784","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:258c8e67-9fd0-411d-bcd5-27a3ca08de5d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4414-1","advisory_id":"258c8e67-9fd0-411d-bcd5-27a3ca08de5d","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.107879+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:37:31+00:00","detail_url":"/events/71339"},"members":[{"id":71339,"cve_ids":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592). - CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594). - CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587). - CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599). Other non-security fixes: - Add a conflicts with previous crypto-policies versions (bsc#1281125)","evidence":"osv:SUSE-SU-2026:4414-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.0-150700.5.53.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4414-1","aliases":["SUSE-SU-2026:4414-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150700.5.53.2"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4414-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.5.0-150700.5.53.2","libopenssl3":"3.5.0-150700.5.53.2","libopenssl3-32bit":"3.5.0-150700.5.53.2","libopenssl-3-devel":"3.5.0-150700.5.53.2","libopenssl-3-fips-provider":"3.5.0-150700.5.53.2","libopenssl-3-fips-provider-32bit":"3.5.0-150700.5.53.2"}]}}],"modified":"2026-10-02T18:30:38.511993727Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264414-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280590","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280592","https://bugzilla.suse.com/1280594","https://bugzilla.suse.com/1280595","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://bugzilla.suse.com/1280599","https://bugzilla.suse.com/1281125","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-35191","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-54875","https://www.suse.com/security/cve/CVE-2026-72897","https://www.suse.com/security/cve/CVE-2026-75804","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782","https://www.suse.com/security/cve/CVE-2026-84784"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-35191","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-54875","evidence":"/upstream"},{"value":"CVE-2026-72897","evidence":"/upstream"},{"value":"CVE-2026-75804","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"},{"value":"CVE-2026-84784","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:258c8e67-9fd0-411d-bcd5-27a3ca08de5d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4414-1","advisory_id":"258c8e67-9fd0-411d-bcd5-27a3ca08de5d","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.107879+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:37:31+00:00","detail_url":"/events/71339"}]}},{"id":70962,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4419-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.4-150600.5.67.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.4-150600.5.67.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4419-1","aliases":["SUSE-SU-2026:4419-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.67.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4419-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.1.4-150600.5.67.1","libopenssl3":"3.1.4-150600.5.67.1","libopenssl3-32bit":"3.1.4-150600.5.67.1","libopenssl-3-devel":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider-32bit":"3.1.4-150600.5.67.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.67.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4419-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.1.4-150600.5.67.1","libopenssl3":"3.1.4-150600.5.67.1","libopenssl3-32bit":"3.1.4-150600.5.67.1","libopenssl-3-devel":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider-32bit":"3.1.4-150600.5.67.1"}]}}],"modified":"2026-10-02T18:30:38.508818054Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264419-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:968cd7d9-c322-4af0-b57a-35cf33518fb7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4419-1","advisory_id":"968cd7d9-c322-4af0-b57a-35cf33518fb7","event_types":["advisory"],"published_at":"2026-10-25T22:45:48.767047+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:23:34+00:00","detail_url":"/advisories/advisory%3A968cd7d9-c322-4af0-b57a-35cf33518fb7","group":{"id":"advisory:968cd7d9-c322-4af0-b57a-35cf33518fb7","revision":1,"primary_event_id":71333,"change":"published","superseded_by":[],"changed":{"id":71333,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4419-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.4-150600.5.67.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.4-150600.5.67.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4419-1","aliases":["SUSE-SU-2026:4419-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.67.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4419-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.1.4-150600.5.67.1","libopenssl3":"3.1.4-150600.5.67.1","libopenssl3-32bit":"3.1.4-150600.5.67.1","libopenssl-3-devel":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider-32bit":"3.1.4-150600.5.67.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.67.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4419-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.1.4-150600.5.67.1","libopenssl3":"3.1.4-150600.5.67.1","libopenssl3-32bit":"3.1.4-150600.5.67.1","libopenssl-3-devel":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider-32bit":"3.1.4-150600.5.67.1"}]}}],"modified":"2026-10-02T18:30:38.508818054Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264419-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:968cd7d9-c322-4af0-b57a-35cf33518fb7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4419-1","advisory_id":"968cd7d9-c322-4af0-b57a-35cf33518fb7","event_types":["advisory"],"published_at":"2026-10-25T22:45:48.767047+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:23:34+00:00","detail_url":"/events/71333"},"members":[{"id":71333,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4419-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.4-150600.5.67.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.4-150600.5.67.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4419-1","aliases":["SUSE-SU-2026:4419-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.67.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4419-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.1.4-150600.5.67.1","libopenssl3":"3.1.4-150600.5.67.1","libopenssl3-32bit":"3.1.4-150600.5.67.1","libopenssl-3-devel":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider-32bit":"3.1.4-150600.5.67.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.67.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4419-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.1.4-150600.5.67.1","libopenssl3":"3.1.4-150600.5.67.1","libopenssl3-32bit":"3.1.4-150600.5.67.1","libopenssl-3-devel":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider":"3.1.4-150600.5.67.1","libopenssl-3-fips-provider-32bit":"3.1.4-150600.5.67.1"}]}}],"modified":"2026-10-02T18:30:38.508818054Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264419-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:968cd7d9-c322-4af0-b57a-35cf33518fb7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4419-1","advisory_id":"968cd7d9-c322-4af0-b57a-35cf33518fb7","event_types":["advisory"],"published_at":"2026-10-25T22:45:48.767047+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:23:34+00:00","detail_url":"/events/71333"}]}},{"id":70961,"cve_ids":["CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3-livepatches","summary":"This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4418-1","products":[{"name":{"value":"openssl-3-livepatches","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.7-150600.13.22.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4418-1","aliases":["SUSE-SU-2026:4418-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150600.13.22.1"}]}],"package":{"name":"openssl-3-livepatches","purl":"pkg:rpm/suse/openssl-3-livepatches&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4418-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3-livepatches":"0.7-150600.13.22.1"}]}}],"modified":"2026-10-02T18:30:38.507516238Z","provider":"osv","upstream":["CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264418-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1282798","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:88704f7f-f931-4df4-a802-e590b20c1bf1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4418-1","advisory_id":"88704f7f-f931-4df4-a802-e590b20c1bf1","event_types":["advisory"],"published_at":"2026-10-25T22:45:47.653789+00:00","technologies":["core-osv","openssl-3-livepatches"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:23:17+00:00","detail_url":"/advisories/advisory%3A88704f7f-f931-4df4-a802-e590b20c1bf1","group":{"id":"advisory:88704f7f-f931-4df4-a802-e590b20c1bf1","revision":1,"primary_event_id":71332,"change":"published","superseded_by":[],"changed":{"id":71332,"cve_ids":["CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3-livepatches","summary":"This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4418-1","products":[{"name":{"value":"openssl-3-livepatches","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.7-150600.13.22.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4418-1","aliases":["SUSE-SU-2026:4418-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150600.13.22.1"}]}],"package":{"name":"openssl-3-livepatches","purl":"pkg:rpm/suse/openssl-3-livepatches&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4418-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3-livepatches":"0.7-150600.13.22.1"}]}}],"modified":"2026-10-02T18:30:38.507516238Z","provider":"osv","upstream":["CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264418-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1282798","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:88704f7f-f931-4df4-a802-e590b20c1bf1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4418-1","advisory_id":"88704f7f-f931-4df4-a802-e590b20c1bf1","event_types":["advisory"],"published_at":"2026-10-25T22:45:47.653789+00:00","technologies":["core-osv","openssl-3-livepatches"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:23:17+00:00","detail_url":"/events/71332"},"members":[{"id":71332,"cve_ids":["CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3-livepatches","summary":"This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4418-1","products":[{"name":{"value":"openssl-3-livepatches","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.7-150600.13.22.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4418-1","aliases":["SUSE-SU-2026:4418-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150600.13.22.1"}]}],"package":{"name":"openssl-3-livepatches","purl":"pkg:rpm/suse/openssl-3-livepatches&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4418-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3-livepatches":"0.7-150600.13.22.1"}]}}],"modified":"2026-10-02T18:30:38.507516238Z","provider":"osv","upstream":["CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264418-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1282798","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:88704f7f-f931-4df4-a802-e590b20c1bf1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4418-1","advisory_id":"88704f7f-f931-4df4-a802-e590b20c1bf1","event_types":["advisory"],"published_at":"2026-10-25T22:45:47.653789+00:00","technologies":["core-osv","openssl-3-livepatches"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:23:17+00:00","detail_url":"/events/71332"}]}},{"id":70960,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4413-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4413-1","aliases":["SUSE-SU-2026:4413-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Micro%205.3","ecosystem":"SUSE:Linux Enterprise Micro 5.3"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"libopenssl3":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Micro%205.4","ecosystem":"SUSE:Linux Enterprise Micro 5.4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"libopenssl3":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}}],"modified":"2026-10-02T18:30:38.499384278Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264413-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:875cba66-4f23-4199-a7e5-ba909e2dc421","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4413-1","advisory_id":"875cba66-4f23-4199-a7e5-ba909e2dc421","event_types":["advisory"],"published_at":"2026-10-25T22:45:46.701753+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:37:17+00:00","detail_url":"/advisories/advisory%3A875cba66-4f23-4199-a7e5-ba909e2dc421","group":{"id":"advisory:875cba66-4f23-4199-a7e5-ba909e2dc421","revision":1,"primary_event_id":71331,"change":"published","superseded_by":[],"changed":{"id":71331,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4413-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4413-1","aliases":["SUSE-SU-2026:4413-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Micro%205.3","ecosystem":"SUSE:Linux Enterprise Micro 5.3"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"libopenssl3":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Micro%205.4","ecosystem":"SUSE:Linux Enterprise Micro 5.4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"libopenssl3":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}}],"modified":"2026-10-02T18:30:38.499384278Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264413-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:875cba66-4f23-4199-a7e5-ba909e2dc421","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4413-1","advisory_id":"875cba66-4f23-4199-a7e5-ba909e2dc421","event_types":["advisory"],"published_at":"2026-10-25T22:45:46.701753+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:37:17+00:00","detail_url":"/events/71331"},"members":[{"id":71331,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4413-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150400.4.101.1","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4413-1","aliases":["SUSE-SU-2026:4413-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Micro%205.3","ecosystem":"SUSE:Linux Enterprise Micro 5.3"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"libopenssl3":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Micro%205.4","ecosystem":"SUSE:Linux Enterprise Micro 5.4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"libopenssl3":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.101.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4413-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150400.4.101.1","libopenssl3":"3.0.8-150400.4.101.1","libopenssl-3-devel":"3.0.8-150400.4.101.1"}]}}],"modified":"2026-10-02T18:30:38.499384278Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264413-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:875cba66-4f23-4199-a7e5-ba909e2dc421","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4413-1","advisory_id":"875cba66-4f23-4199-a7e5-ba909e2dc421","event_types":["advisory"],"published_at":"2026-10-25T22:45:46.701753+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:37:17+00:00","detail_url":"/events/71331"}]}},{"id":70958,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4412-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4412-1","aliases":["SUSE-SU-2026:4412-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}}],"modified":"2026-10-02T18:30:38.497837462Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264412-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7759e880-924b-415a-b962-95044731e7b3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4412-1","advisory_id":"7759e880-924b-415a-b962-95044731e7b3","event_types":["advisory"],"published_at":"2026-10-25T22:45:37.062622+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:36:25+00:00","detail_url":"/advisories/advisory%3A7759e880-924b-415a-b962-95044731e7b3","group":{"id":"advisory:7759e880-924b-415a-b962-95044731e7b3","revision":1,"primary_event_id":71329,"change":"published","superseded_by":[],"changed":{"id":71329,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4412-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4412-1","aliases":["SUSE-SU-2026:4412-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}}],"modified":"2026-10-02T18:30:38.497837462Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264412-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7759e880-924b-415a-b962-95044731e7b3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4412-1","advisory_id":"7759e880-924b-415a-b962-95044731e7b3","event_types":["advisory"],"published_at":"2026-10-25T22:45:37.062622+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:36:25+00:00","detail_url":"/events/71329"},"members":[{"id":71329,"cve_ids":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"payload":{"kind":"advisory","title":"Security update for openssl-3","summary":"This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).","evidence":"osv:SUSE-SU-2026:4412-1","products":[{"name":{"value":"openssl-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"openssl-3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8-150500.5.80.1","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4412-1","aliases":["SUSE-SU-2026:4412-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.80.1"}]}],"package":{"name":"openssl-3","purl":"pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4412-1.json"},"ecosystem_specific":{"binaries":[{"openssl-3":"3.0.8-150500.5.80.1","libopenssl3":"3.0.8-150500.5.80.1","libopenssl-3-devel":"3.0.8-150500.5.80.1"}]}}],"modified":"2026-10-02T18:30:38.497837462Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-54872","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264412-1/","https://bugzilla.suse.com/1280587","https://bugzilla.suse.com/1280589","https://bugzilla.suse.com/1280591","https://bugzilla.suse.com/1280596","https://bugzilla.suse.com/1280597","https://bugzilla.suse.com/1280598","https://www.suse.com/security/cve/CVE-2026-35189","https://www.suse.com/security/cve/CVE-2026-54872","https://www.suse.com/security/cve/CVE-2026-75805","https://www.suse.com/security/cve/CVE-2026-75806","https://www.suse.com/security/cve/CVE-2026-77696","https://www.suse.com/security/cve/CVE-2026-84782"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7759e880-924b-415a-b962-95044731e7b3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4412-1","advisory_id":"7759e880-924b-415a-b962-95044731e7b3","event_types":["advisory"],"published_at":"2026-10-25T22:45:37.062622+00:00","technologies":["core-osv","openssl-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T07:36:25+00:00","detail_url":"/events/71329"}]}},{"id":67657,"cve_ids":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"payload":{"kind":"advisory","title":"openssl vulnerabilities","summary":"It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. (CVE-2026-35189) It was discovered that OpenSSL incorrectly handled QUIC unvalidated amplification credit accounting. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-35191) It was discovered that OpenSSL incorrectly implemented scalar multiplication for non-NIST elliptic curves. An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive information. (CVE-2026-54872) It was discovered that OpenSSL incorrectly implemented SM2 scalar multiplication on ARM64 and RISC-V architectures. An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54875) It was discovered that OpenSSL incorrectly handled SSL context switching during a TLS handshake. An attacker could possibly use this issue to cause an out-of-bounds read, resulting in a denial of service or obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-72897) It was discovered that OpenSSL incorrectly enforced QUIC connection- level flow control for streams. An attacker could possibly use this issue to cause OpenSSL to consume excessive me","evidence":"osv:USN-8847-1","products":[{"name":{"value":"openssl","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2-0ubuntu1.30","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"1.1.1l-1ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.0-1ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.1-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.2","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.4","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.5","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.6","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.7","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.8","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.9","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.10","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.12","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.13","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.14","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.15","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.16","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.17","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.18","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.19","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.20","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.21","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.23","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.25","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.26","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.29","evidence":"/affected/0/versions"}]},{"name":{"value":"openssl","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.13-0ubuntu3.16","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.10-1ubuntu2","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu2.1","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu3","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu4","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu2","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.1","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.2","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.3","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.4","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.5","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.6","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.7","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.9","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.11","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.12","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.15","evidence":"/affected/1/versions"}]},{"name":{"value":"openssl","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.5-1ubuntu3.6","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"3.5.3-1ubuntu2","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu1","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.2","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.3","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.4","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.5","evidence":"/affected/2/versions"}]}],"severity":"unknown","structured":{"id":"USN-8847-1","aliases":["USN-8847-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.30"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=jammy","ecosystem":"Ubuntu:22.04:LTS"},"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21","3.0.2-0ubuntu1.23","3.0.2-0ubuntu1.25","3.0.2-0ubuntu1.26","3.0.2-0ubuntu1.29"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]}],"ecosystem":"Ubuntu:22.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.30"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.30"}],"availability":"No subscription required"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.16"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=noble","ecosystem":"Ubuntu:24.04:LTS"},"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7","3.0.13-0ubuntu3.9","3.0.13-0ubuntu3.11","3.0.13-0ubuntu3.12","3.0.13-0ubuntu3.15"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]}],"ecosystem":"Ubuntu:24.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.0.13-0ubuntu3.16"},{"binary_name":"openssl","binary_version":"3.0.13-0ubuntu3.16"}],"availability":"No subscription required"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.6"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=resolute","ecosystem":"Ubuntu:26.04:LTS"},"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3","3.5.5-1ubuntu3.2","3.5.5-1ubuntu3.3","3.5.5-1ubuntu3.4","3.5.5-1ubuntu3.5"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-35191","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54875","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-72897","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75804","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]},{"id":"CVE-2026-84784","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}],"ecosystem":"Ubuntu:26.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.5.5-1ubuntu3.6"},{"binary_name":"openssl","binary_version":"3.5.5-1ubuntu3.6"},{"binary_name":"openssl-provider-legacy","binary_version":"3.5.5-1ubuntu3.6"}],"availability":"No subscription required"}}],"modified":"2026-10-02T12:17:34.659927325Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784","UBUNTU-CVE-2026-35189","UBUNTU-CVE-2026-35191","UBUNTU-CVE-2026-54872","UBUNTU-CVE-2026-54875","UBUNTU-CVE-2026-72897","UBUNTU-CVE-2026-75804","UBUNTU-CVE-2026-75805","UBUNTU-CVE-2026-75806","UBUNTU-CVE-2026-77696","UBUNTU-CVE-2026-84782","UBUNTU-CVE-2026-84784"],"references":["https://ubuntu.com/security/notices/USN-8847-1","https://ubuntu.com/security/CVE-2026-35189","https://ubuntu.com/security/CVE-2026-35191","https://ubuntu.com/security/CVE-2026-54872","https://ubuntu.com/security/CVE-2026-54875","https://ubuntu.com/security/CVE-2026-72897","https://ubuntu.com/security/CVE-2026-75804","https://ubuntu.com/security/CVE-2026-75805","https://ubuntu.com/security/CVE-2026-75806","https://ubuntu.com/security/CVE-2026-77696","https://ubuntu.com/security/CVE-2026-84782","https://ubuntu.com/security/CVE-2026-84784"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-35191","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-54875","evidence":"/upstream"},{"value":"CVE-2026-72897","evidence":"/upstream"},{"value":"CVE-2026-75804","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"},{"value":"CVE-2026-84784","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0c3308c2-1be6-4848-97c4-696e9aa01de6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/USN-8847-1","advisory_id":"0c3308c2-1be6-4848-97c4-696e9aa01de6","event_types":["advisory"],"published_at":"2026-10-25T21:20:22.48955+00:00","technologies":["core-osv","openssl"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T18:19:43+00:00","detail_url":"/advisories/advisory%3A0c3308c2-1be6-4848-97c4-696e9aa01de6","group":{"id":"advisory:0c3308c2-1be6-4848-97c4-696e9aa01de6","revision":1,"primary_event_id":68027,"change":"published","superseded_by":[],"changed":{"id":68027,"cve_ids":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"payload":{"kind":"advisory","title":"openssl vulnerabilities","summary":"It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. (CVE-2026-35189) It was discovered that OpenSSL incorrectly handled QUIC unvalidated amplification credit accounting. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-35191) It was discovered that OpenSSL incorrectly implemented scalar multiplication for non-NIST elliptic curves. An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive information. (CVE-2026-54872) It was discovered that OpenSSL incorrectly implemented SM2 scalar multiplication on ARM64 and RISC-V architectures. An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54875) It was discovered that OpenSSL incorrectly handled SSL context switching during a TLS handshake. An attacker could possibly use this issue to cause an out-of-bounds read, resulting in a denial of service or obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-72897) It was discovered that OpenSSL incorrectly enforced QUIC connection- level flow control for streams. An attacker could possibly use this issue to cause OpenSSL to consume excessive me","evidence":"osv:USN-8847-1","products":[{"name":{"value":"openssl","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2-0ubuntu1.30","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"1.1.1l-1ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.0-1ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.1-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.2","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.4","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.5","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.6","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.7","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.8","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.9","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.10","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.12","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.13","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.14","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.15","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.16","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.17","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.18","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.19","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.20","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.21","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.23","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.25","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.26","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.29","evidence":"/affected/0/versions"}]},{"name":{"value":"openssl","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.13-0ubuntu3.16","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.10-1ubuntu2","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu2.1","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu3","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu4","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu2","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.1","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.2","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.3","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.4","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.5","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.6","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.7","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.9","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.11","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.12","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.15","evidence":"/affected/1/versions"}]},{"name":{"value":"openssl","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.5-1ubuntu3.6","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"3.5.3-1ubuntu2","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu1","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.2","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.3","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.4","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.5","evidence":"/affected/2/versions"}]}],"severity":"unknown","structured":{"id":"USN-8847-1","aliases":["USN-8847-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.30"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=jammy","ecosystem":"Ubuntu:22.04:LTS"},"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21","3.0.2-0ubuntu1.23","3.0.2-0ubuntu1.25","3.0.2-0ubuntu1.26","3.0.2-0ubuntu1.29"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]}],"ecosystem":"Ubuntu:22.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.30"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.30"}],"availability":"No subscription required"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.16"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=noble","ecosystem":"Ubuntu:24.04:LTS"},"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7","3.0.13-0ubuntu3.9","3.0.13-0ubuntu3.11","3.0.13-0ubuntu3.12","3.0.13-0ubuntu3.15"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]}],"ecosystem":"Ubuntu:24.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.0.13-0ubuntu3.16"},{"binary_name":"openssl","binary_version":"3.0.13-0ubuntu3.16"}],"availability":"No subscription required"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.6"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=resolute","ecosystem":"Ubuntu:26.04:LTS"},"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3","3.5.5-1ubuntu3.2","3.5.5-1ubuntu3.3","3.5.5-1ubuntu3.4","3.5.5-1ubuntu3.5"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-35191","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54875","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-72897","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75804","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]},{"id":"CVE-2026-84784","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}],"ecosystem":"Ubuntu:26.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.5.5-1ubuntu3.6"},{"binary_name":"openssl","binary_version":"3.5.5-1ubuntu3.6"},{"binary_name":"openssl-provider-legacy","binary_version":"3.5.5-1ubuntu3.6"}],"availability":"No subscription required"}}],"modified":"2026-10-02T12:17:34.659927325Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784","UBUNTU-CVE-2026-35189","UBUNTU-CVE-2026-35191","UBUNTU-CVE-2026-54872","UBUNTU-CVE-2026-54875","UBUNTU-CVE-2026-72897","UBUNTU-CVE-2026-75804","UBUNTU-CVE-2026-75805","UBUNTU-CVE-2026-75806","UBUNTU-CVE-2026-77696","UBUNTU-CVE-2026-84782","UBUNTU-CVE-2026-84784"],"references":["https://ubuntu.com/security/notices/USN-8847-1","https://ubuntu.com/security/CVE-2026-35189","https://ubuntu.com/security/CVE-2026-35191","https://ubuntu.com/security/CVE-2026-54872","https://ubuntu.com/security/CVE-2026-54875","https://ubuntu.com/security/CVE-2026-72897","https://ubuntu.com/security/CVE-2026-75804","https://ubuntu.com/security/CVE-2026-75805","https://ubuntu.com/security/CVE-2026-75806","https://ubuntu.com/security/CVE-2026-77696","https://ubuntu.com/security/CVE-2026-84782","https://ubuntu.com/security/CVE-2026-84784"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-35191","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-54875","evidence":"/upstream"},{"value":"CVE-2026-72897","evidence":"/upstream"},{"value":"CVE-2026-75804","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"},{"value":"CVE-2026-84784","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0c3308c2-1be6-4848-97c4-696e9aa01de6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/USN-8847-1","advisory_id":"0c3308c2-1be6-4848-97c4-696e9aa01de6","event_types":["advisory"],"published_at":"2026-10-25T21:20:22.48955+00:00","technologies":["core-osv","openssl"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T18:19:43+00:00","detail_url":"/events/68027"},"members":[{"id":68027,"cve_ids":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784"],"payload":{"kind":"advisory","title":"openssl vulnerabilities","summary":"It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. (CVE-2026-35189) It was discovered that OpenSSL incorrectly handled QUIC unvalidated amplification credit accounting. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-35191) It was discovered that OpenSSL incorrectly implemented scalar multiplication for non-NIST elliptic curves. An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive information. (CVE-2026-54872) It was discovered that OpenSSL incorrectly implemented SM2 scalar multiplication on ARM64 and RISC-V architectures. An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54875) It was discovered that OpenSSL incorrectly handled SSL context switching during a TLS handshake. An attacker could possibly use this issue to cause an out-of-bounds read, resulting in a denial of service or obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-72897) It was discovered that OpenSSL incorrectly enforced QUIC connection- level flow control for streams. An attacker could possibly use this issue to cause OpenSSL to consume excessive me","evidence":"osv:USN-8847-1","products":[{"name":{"value":"openssl","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.2-0ubuntu1.30","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"1.1.1l-1ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.0-1ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.1-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.1","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.2","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.4","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.5","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.6","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.7","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.8","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.9","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.10","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.12","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.13","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.14","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.15","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.16","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.17","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.18","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.19","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.20","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.21","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.23","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.25","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.26","evidence":"/affected/0/versions"},{"value":"3.0.2-0ubuntu1.29","evidence":"/affected/0/versions"}]},{"name":{"value":"openssl","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.13-0ubuntu3.16","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"3.0.10-1ubuntu2","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu2.1","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu3","evidence":"/affected/1/versions"},{"value":"3.0.10-1ubuntu4","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu2","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.1","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.2","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.3","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.4","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.5","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.6","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.7","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.9","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.11","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.12","evidence":"/affected/1/versions"},{"value":"3.0.13-0ubuntu3.15","evidence":"/affected/1/versions"}]},{"name":{"value":"openssl","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.5.5-1ubuntu3.6","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"3.5.3-1ubuntu2","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu1","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.2","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.3","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.4","evidence":"/affected/2/versions"},{"value":"3.5.5-1ubuntu3.5","evidence":"/affected/2/versions"}]}],"severity":"unknown","structured":{"id":"USN-8847-1","aliases":["USN-8847-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.30"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=jammy","ecosystem":"Ubuntu:22.04:LTS"},"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21","3.0.2-0ubuntu1.23","3.0.2-0ubuntu1.25","3.0.2-0ubuntu1.26","3.0.2-0ubuntu1.29"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]}],"ecosystem":"Ubuntu:22.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.30"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.30"}],"availability":"No subscription required"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.16"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=noble","ecosystem":"Ubuntu:24.04:LTS"},"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7","3.0.13-0ubuntu3.9","3.0.13-0ubuntu3.11","3.0.13-0ubuntu3.12","3.0.13-0ubuntu3.15"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]}],"ecosystem":"Ubuntu:24.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.0.13-0ubuntu3.16"},{"binary_name":"openssl","binary_version":"3.0.13-0ubuntu3.16"}],"availability":"No subscription required"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.6"}]}],"package":{"name":"openssl","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=resolute","ecosystem":"Ubuntu:26.04:LTS"},"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3","3.5.5-1ubuntu3.2","3.5.5-1ubuntu3.3","3.5.5-1ubuntu3.4","3.5.5-1ubuntu3.5"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8847-1.json","cves_map":{"cves":[{"id":"CVE-2026-35189","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-35191","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54872","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-54875","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-72897","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75804","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75805","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-75806","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-77696","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2026-84782","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"type":"Ubuntu","score":"high"}]},{"id":"CVE-2026-84784","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}],"ecosystem":"Ubuntu:26.04:LTS"}},"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.5.5-1ubuntu3.6"},{"binary_name":"openssl","binary_version":"3.5.5-1ubuntu3.6"},{"binary_name":"openssl-provider-legacy","binary_version":"3.5.5-1ubuntu3.6"}],"availability":"No subscription required"}}],"modified":"2026-10-02T12:17:34.659927325Z","provider":"osv","upstream":["CVE-2026-35189","CVE-2026-35191","CVE-2026-54872","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784","UBUNTU-CVE-2026-35189","UBUNTU-CVE-2026-35191","UBUNTU-CVE-2026-54872","UBUNTU-CVE-2026-54875","UBUNTU-CVE-2026-72897","UBUNTU-CVE-2026-75804","UBUNTU-CVE-2026-75805","UBUNTU-CVE-2026-75806","UBUNTU-CVE-2026-77696","UBUNTU-CVE-2026-84782","UBUNTU-CVE-2026-84784"],"references":["https://ubuntu.com/security/notices/USN-8847-1","https://ubuntu.com/security/CVE-2026-35189","https://ubuntu.com/security/CVE-2026-35191","https://ubuntu.com/security/CVE-2026-54872","https://ubuntu.com/security/CVE-2026-54875","https://ubuntu.com/security/CVE-2026-72897","https://ubuntu.com/security/CVE-2026-75804","https://ubuntu.com/security/CVE-2026-75805","https://ubuntu.com/security/CVE-2026-75806","https://ubuntu.com/security/CVE-2026-77696","https://ubuntu.com/security/CVE-2026-84782","https://ubuntu.com/security/CVE-2026-84784"]},"related_cves":[{"value":"CVE-2026-35189","evidence":"/upstream"},{"value":"CVE-2026-35191","evidence":"/upstream"},{"value":"CVE-2026-54872","evidence":"/upstream"},{"value":"CVE-2026-54875","evidence":"/upstream"},{"value":"CVE-2026-72897","evidence":"/upstream"},{"value":"CVE-2026-75804","evidence":"/upstream"},{"value":"CVE-2026-75805","evidence":"/upstream"},{"value":"CVE-2026-75806","evidence":"/upstream"},{"value":"CVE-2026-77696","evidence":"/upstream"},{"value":"CVE-2026-84782","evidence":"/upstream"},{"value":"CVE-2026-84784","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0c3308c2-1be6-4848-97c4-696e9aa01de6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/USN-8847-1","advisory_id":"0c3308c2-1be6-4848-97c4-696e9aa01de6","event_types":["advisory"],"published_at":"2026-10-25T21:20:22.48955+00:00","technologies":["core-osv","openssl"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T18:19:43+00:00","detail_url":"/events/68027"}]}}],"next_after":70966,"next_before":67657}