UnratedFix available

FreeBSD-EN-26:15.openssl Errata Notice

FreeBSD updates OpenSSL on supported FreeBSD branches to address multiple issues. Upgrade to the applicable corrected release; a reboot is required.

Products: FreeBSD 14, FreeBSD 15
Affected versions: 14.3-RELEASE, 14.4-RELEASE, 15.0-RELEASE
Fixed versions: 14.3-RELEASE-p15, 14.4-RELEASE-p6, 15.0-RELEASE-p10
CVEs: CVE-2026-2673, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-31789, CVE-2026-31790
Confirmed fixed CVEs: Not specified
Updated in this feed: 31 Oct 2026, 21:07 UTC · Revision 1

Source evidence

FreeBSD-EN-26:15.openssl Errata Notice

official-freebsd-security · Original source

Published 9 Jun 2026, 00:00 UTC

FreeBSD updates OpenSSL on supported FreeBSD branches to address multiple issues. Upgrade to the applicable corrected release; a reboot is required.

This update imports the current upstream point release on each branch.

FreeBSD 15

Fixed versions: 15.0-RELEASE-p10

FreeBSD 14

Fixed versions: 14.4-RELEASE-p6, 14.3-RELEASE-p15

Complete source record

{
  "id": "ce737491bcfd44ea25d3698434c3ff5ad78ffd6062341db47dd2fc424c2fb161",
  "url": "https://www.freebsd.org/security/advisories/FreeBSD-EN-26:15.openssl.asc",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "FreeBSD-EN-26:15.openssl Errata Notice",
    "summary": "FreeBSD updates OpenSSL on supported FreeBSD branches to address multiple issues. Upgrade to the applicable corrected release; a reboot is required.",
    "evidence": "This update imports the current upstream point release on each branch.",
    "products": [
      {
        "name": {
          "value": "FreeBSD 15",
          "evidence": "Issues affecting FreeBSD 15 (OpenSSL 3.5):"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "15.0-RELEASE-p10",
            "evidence": "releng/15.0, 15.0-RELEASE-p10"
          }
        ],
        "affected_versions": [
          {
            "value": "15.0-RELEASE",
            "evidence": "releng/15.0, 15.0-RELEASE-p10"
          }
        ]
      },
      {
        "name": {
          "value": "FreeBSD 14",
          "evidence": "Issues affecting FreeBSD 14 (OpenSSL 3.0):"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "14.4-RELEASE-p6",
            "evidence": "releng/14.4, 14.4-RELEASE-p6"
          },
          {
            "value": "14.3-RELEASE-p15",
            "evidence": "releng/14.3, 14.3-RELEASE-p15"
          }
        ],
        "affected_versions": [
          {
            "value": "14.4-RELEASE",
            "evidence": "releng/14.4, 14.4-RELEASE-p6"
          },
          {
            "value": "14.3-RELEASE",
            "evidence": "releng/14.3, 14.3-RELEASE-p15"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-2673",
        "evidence": "CVE-2026-2673 - DEFAULT keyword corrupts the key-agreement group list"
      },
      {
        "value": "CVE-2026-28387",
        "evidence": "CVE-2026-28387 - Possible use-after-free in DANE client code"
      },
      {
        "value": "CVE-2026-28388",
        "evidence": "CVE-2026-28388 - NULL dereference when processing a delta CRL"
      },
      {
        "value": "CVE-2026-28389",
        "evidence": "CVE-2026-28389 - NULL dereference processing CMS KeyAgreeRecipientInfo"
      },
      {
        "value": "CVE-2026-31789",
        "evidence": "CVE-2026-31789 - Heap buffer overflow in hexadecimal conversion"
      },
      {
        "value": "CVE-2026-31790",
        "evidence": "CVE-2026-31790 - NULL dereference processing CMS KeyTransRecipientInfo"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-freebsd-security",
  "document_id": 23610,
  "published_at": "2026-06-09T00:00:00+00:00"
}