CVE catalog

CVE-2026-54874

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a s

[CVE catalog]

Severity: Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Aug 25, 2026, 12:00:00 AM UTC
Updated: Aug 25, 2026, 1:19:24 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.62% · Oct 22, 2026

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssl	sid	`3.6.5-1`	fixed
Debian	openssl	forky	`3.6.5-1`	fixed
Debian	openssl	trixie	`3.5.7-1~deb13u2`	fixed
Debian	openssl	trixie-security	`3.5.7-1~deb13u3`	fixed
Debian	openssl	bookworm	`3.0.20-1~deb12u2`	vulnerable
Debian	openssl	bookworm-security	`3.0.22-1~deb12u1`	fixed
Ubuntu	openssl	noble	`3.0.13-0ubuntu3.15`	fixed
Ubuntu	libssl-dev	noble	`3.0.13-0ubuntu3.15`	fixed
Ubuntu	libssl-doc	noble	`3.0.13-0ubuntu3.15`	fixed
Ubuntu	libssl3t64	noble	`3.0.13-0ubuntu3.15`	fixed
Cpe	openssl	Not reported	`4.0.2`	fixed
Ubuntu	edk2	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	efi-shell-aa64	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	efi-shell-arm	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	efi-shell-ia32	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	efi-shell-riscv64	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	efi-shell-x64	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	ovmf	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	ovmf-ia32	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	ovmf-legacy	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	qemu-efi-aarch64	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	qemu-efi-arm	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	qemu-efi-riscv64	noble	`2024.02-2ubuntu0.10`	fixed
Ubuntu	edk2	pro	`0~20190606.20d2e5a1-2ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20190828.37eef910-3`	vulnerable
Ubuntu	edk2	pro	`0~20190828.37eef910-4`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-1ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.3`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.4`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.5`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.6`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.6+esm1`	fixed
Ubuntu	edk2	22.04	`2021.08~rc0-2`	vulnerable
Ubuntu	edk2	22.04	`2021.08-3`	vulnerable
Ubuntu	edk2	22.04	`2021.11~rc1-1`	vulnerable
Ubuntu	edk2	22.04	`2021.11-1`	vulnerable
Ubuntu	edk2	22.04	`2021.11-2`	vulnerable
Ubuntu	edk2	22.04	`2022.02~rc1-1`	vulnerable
Ubuntu	edk2	22.04	`2022.02~rc1-1ubuntu1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-2`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.2`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.3`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.4`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.5`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.6`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.7`	fixed
Ubuntu	edk2	24.04	`2023.05-2`	vulnerable
Ubuntu	edk2	24.04	`2023.11-2`	vulnerable
Ubuntu	edk2	24.04	`2023.11-3`	vulnerable
Ubuntu	edk2	24.04	`2023.11-4`	vulnerable
Ubuntu	edk2	24.04	`2023.11-5`	vulnerable
Ubuntu	edk2	24.04	`2023.11-6`	vulnerable
Ubuntu	edk2	24.04	`2023.11-8`	vulnerable
Ubuntu	edk2	24.04	`2024.02-1`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.1`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.3`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.4`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.5`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.6`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.7`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.8`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.9`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.10`	fixed
Ubuntu	edk2	26.04	`2025.02-8ubuntu3`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu6`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu7`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu7.2`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu7.3`	fixed
Alpine	openssl	3.22	`3.5.8-r0`	fixed
Alpine	openssl	3.23	`3.5.8-r0`	fixed
Alpine	openssl	3.24	`3.5.8-r0`	fixed
Suse	openssl-3	linux micro 6.1	`3.1.4-slfo.1.1_13.1`	fixed
Suse	openssl-3	linux micro 6.0	`3.1.4-17.1`	fixed
Suse	openssl-1_1	linux enterprise server 12 sp5-ltss	`1.1.1d-2.139.1`	fixed
Suse	openssl-1_1	linux enterprise server ltss extended security 12 sp5	`1.1.1d-2.139.1`	fixed
Suse	openssl-1_1	linux enterprise module for basesystem 15 sp7	`1.1.1w-150700.11.30.1`	fixed
Suse	openssl-1_1	linux enterprise module for development tools 15 sp7	`1.1.1w-150700.11.30.1`	fixed
Suse	openssl-1_1	linux enterprise module for legacy 15 sp7	`1.1.1w-150700.11.30.1`	fixed
Suse	openssl-3	linux enterprise micro 5.3	`3.0.8-150400.4.98.1`	fixed
Suse	openssl-3	linux enterprise micro 5.4	`3.0.8-150400.4.98.1`	fixed
Suse	openssl-3	linux enterprise high performance computing 15 sp4-espos	`3.0.8-150400.4.98.1`	fixed
Suse	openssl-3	linux enterprise high performance computing 15 sp4-ltss	`3.0.8-150400.4.98.1`	fixed
Suse	openssl-3	linux enterprise server 15 sp4-ltss	`3.0.8-150400.4.98.1`	fixed
Suse	openssl-3	linux enterprise server for sap applications 15 sp4	`3.0.8-150400.4.98.1`	fixed
Suse	openssl-1_1	linux enterprise micro 5.3	`1.1.1l-150400.7.104.1`	fixed
Suse	openssl-1_1	linux enterprise micro 5.4	`1.1.1l-150400.7.104.1`	fixed
Suse	openssl-1_1	linux enterprise high performance computing 15 sp4-espos	`1.1.1l-150400.7.104.1`	fixed
Suse	openssl-1_1	linux enterprise high performance computing 15 sp4-ltss	`1.1.1l-150400.7.104.1`	fixed
Suse	openssl-1_1	linux enterprise server 15 sp4-ltss	`1.1.1l-150400.7.104.1`	fixed
Suse	openssl-1_1	linux enterprise server for sap applications 15 sp4	`1.1.1l-150400.7.104.1`	fixed
Suse	openssl-1_1	linux enterprise server 15 sp6-ltss	`1.1.1w-150600.5.38.1`	fixed
Suse	openssl-1_1	linux enterprise server for sap applications 15 sp6	`1.1.1w-150600.5.38.1`	fixed
Suse	openssl-1_1	linux enterprise micro 5.5	`1.1.1l-150500.17.63.1`	fixed
Suse	openssl-1_1	linux enterprise high performance computing 15 sp5-espos	`1.1.1l-150500.17.63.1`	fixed
Suse	openssl-1_1	linux enterprise high performance computing 15 sp5-ltss	`1.1.1l-150500.17.63.1`	fixed
Suse	openssl-1_1	linux enterprise server 15 sp5-ltss	`1.1.1l-150500.17.63.1`	fixed
Suse	openssl-1_1	linux enterprise server for sap applications 15 sp5	`1.1.1l-150500.17.63.1`	fixed
Suse	openssl-3	linux enterprise high performance computing 15 sp5-espos	`3.0.8-150500.5.75.1`	fixed
Suse	openssl-3	linux enterprise high performance computing 15 sp5-ltss	`3.0.8-150500.5.75.1`	fixed
Suse	openssl-3	linux enterprise server 15 sp5-ltss	`3.0.8-150500.5.75.1`	fixed
Suse	openssl-3	linux enterprise server for sap applications 15 sp5	`3.0.8-150500.5.75.1`	fixed
Suse	openssl-3	linux enterprise server 15 sp6-ltss	`3.1.4-150600.5.64.1`	fixed
Suse	openssl-3	linux enterprise server for sap applications 15 sp6	`3.1.4-150600.5.64.1`	fixed
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.10+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.12+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.14+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.15+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.16+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.17+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.18+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.19+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.20+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.21+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.23+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.25+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.26+Fips1`	vulnerable
Ubuntu	openssl	pro	`3.0.2-0ubuntu1.29+Fips1`	fixed
Ubuntu	edk2	pro	`0~20190606.20d2e5a1-2ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20190828.37eef910-3`	vulnerable
Ubuntu	edk2	pro	`0~20190828.37eef910-4`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-1ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.1`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.2`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.3`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.4`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.5`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.6`	vulnerable
Ubuntu	edk2	pro	`0~20191122.bd85bf54-2ubuntu3.6+esm1`	fixed
Ubuntu	nodejs	pro	`12.22.5~dfsg-5ubuntu1`	vulnerable
Ubuntu	nodejs	pro	`12.22.7~dfsg-2ubuntu1`	vulnerable
Ubuntu	nodejs	pro	`12.22.7~dfsg-2ubuntu3`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu2`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.1`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.2`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.3`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.4`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.5`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.6`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.6+esm2`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu2`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu3`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu4`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.1`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.2`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.3`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.4`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.5`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.6`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.7`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.8`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.9`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.10`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.11`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.12`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13+esm1`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13+esm2`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13+esm3`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13+esm4`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13+esm5`	vulnerable
Ubuntu	openssl1.0	pro	`1.0.2n-1ubuntu5.13+esm6`	fixed
Ubuntu	edk2	22.04	`2021.08~rc0-2`	vulnerable
Ubuntu	edk2	22.04	`2021.08-3`	vulnerable
Ubuntu	edk2	22.04	`2021.11~rc1-1`	vulnerable
Ubuntu	edk2	22.04	`2021.11-1`	vulnerable
Ubuntu	edk2	22.04	`2021.11-2`	vulnerable
Ubuntu	edk2	22.04	`2022.02~rc1-1`	vulnerable
Ubuntu	edk2	22.04	`2022.02~rc1-1ubuntu1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-2`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.1`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.2`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.3`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.4`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.5`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.6`	vulnerable
Ubuntu	edk2	22.04	`2022.02-3ubuntu0.22.04.7`	fixed
Ubuntu	openssl	22.04	`1.1.1l-1ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.0-1ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.1-0ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.1`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.2`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.4`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.5`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.6`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.7`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.8`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.9`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.10`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.12`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.13`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.14`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.15`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.16`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.17`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.18`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.19`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.20`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.21`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.23`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.25`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.26`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.29`	fixed
Ubuntu	openssl-fips	pro	`3.0.13-0ubuntu3+Fips1`	vulnerable
Ubuntu	openssl-fips	pro	`3.0.13-0ubuntu3.6+Fips1`	vulnerable
Ubuntu	openssl-fips	pro	`3.0.13-0ubuntu3.12+Fips1`	vulnerable
Ubuntu	openssl-fips	pro	`3.0.13-0ubuntu3.15+Fips1`	fixed
Ubuntu	edk2	24.04	`2023.05-2`	vulnerable
Ubuntu	edk2	24.04	`2023.11-2`	vulnerable
Ubuntu	edk2	24.04	`2023.11-3`	vulnerable
Ubuntu	edk2	24.04	`2023.11-4`	vulnerable
Ubuntu	edk2	24.04	`2023.11-5`	vulnerable
Ubuntu	edk2	24.04	`2023.11-6`	vulnerable
Ubuntu	edk2	24.04	`2023.11-8`	vulnerable
Ubuntu	edk2	24.04	`2024.02-1`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.1`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.3`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.4`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.5`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.6`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.7`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.8`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.9`	vulnerable
Ubuntu	edk2	24.04	`2024.02-2ubuntu0.10`	fixed
Ubuntu	openssl	24.04	`3.0.10-1ubuntu2`	vulnerable
Ubuntu	openssl	24.04	`3.0.10-1ubuntu2.1`	vulnerable
Ubuntu	openssl	24.04	`3.0.10-1ubuntu3`	vulnerable
Ubuntu	openssl	24.04	`3.0.10-1ubuntu4`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu2`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.1`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.2`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.3`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.4`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.5`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.6`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.7`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.9`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.11`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.12`	vulnerable
Ubuntu	openssl	24.04	`3.0.13-0ubuntu3.15`	fixed
Ubuntu	edk2	26.10	`2025.11-3ubuntu7`	vulnerable
Ubuntu	edk2	26.10	`2025.11-3ubuntu8`	vulnerable
Ubuntu	edk2	26.10	`2026.05-2ubuntu1`	vulnerable
Ubuntu	edk2	26.10	`2026.05-2ubuntu2`	vulnerable
Ubuntu	edk2	26.10	`2026.05-2ubuntu3`	vulnerable
Ubuntu	edk2-hwe	26.10	`2025.11-3ubuntu8`	vulnerable
Ubuntu	edk2-hwe	26.10	`2025.11-3ubuntu9`	vulnerable
Ubuntu	edk2-hwe	26.10	`2026.05-2ubuntu1`	vulnerable
Ubuntu	edk2-hwe	26.10	`2026.05-2ubuntu2`	vulnerable
Ubuntu	edk2-hwe	26.10	`2026.05-2ubuntu3`	vulnerable
Ubuntu	edk2	26.04	`2025.02-8ubuntu3`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu6`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu7`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu7.2`	vulnerable
Ubuntu	edk2	26.04	`2025.11-3ubuntu7.3`	fixed
Ubuntu	edk2-hwe	26.04	`2025.11-3ubuntu6`	vulnerable
Ubuntu	edk2-hwe	26.04	`2025.11-3ubuntu8`	vulnerable
Ubuntu	edk2-hwe	26.04	`2025.11-3ubuntu8.2`	vulnerable
Ubuntu	openssl	26.04	`3.5.3-1ubuntu2`	vulnerable
Ubuntu	openssl	26.04	`3.5.5-1ubuntu1`	vulnerable
Ubuntu	openssl	26.04	`3.5.5-1ubuntu3`	vulnerable
Ubuntu	openssl	26.04	`3.5.5-1ubuntu3.2`	vulnerable
Ubuntu	openssl	26.04	`3.5.5-1ubuntu3.3`	vulnerable
Ubuntu	openssl	26.04	`3.5.5-1ubuntu3.4`	fixed
Suse	openssl-1_0_0	linux enterprise server 12 sp5-ltss	`1.0.2p-3.115.1`	fixed
Suse	openssl-1_0_0	linux enterprise server ltss extended security 12 sp5	`1.0.2p-3.115.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssl	source	sid	`3.6.4-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	forky	`3.6.4-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	trixie	`3.5.7-1~deb13u2`	not yet assigned	Not reported	Not reported
Debian	openssl	source	bookworm	`3.0.22-1~deb12u1`	not yet assigned	Not reported	Not reported
Ubuntu	openssl	deb	noble	`3.0.13-0ubuntu3.15`	Not reported	Not reported	Not reported
Ubuntu	libssl-dev	deb	noble	`3.0.13-0ubuntu3.15`	Not reported	Not reported	Not reported
Ubuntu	libssl-doc	deb	noble	`3.0.13-0ubuntu3.15`	Not reported	Not reported	Not reported
Ubuntu	libssl3t64	deb	noble	`3.0.13-0ubuntu3.15`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`4.0.2`	Not reported	NVD-CVE-2026-54874	Not reported
Ubuntu	edk2	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-aa64	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-arm	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-ia32	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-riscv64	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	efi-shell-x64	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	ovmf	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	ovmf-ia32	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	ovmf-legacy	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	qemu-efi-aarch64	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	qemu-efi-arm	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	qemu-efi-riscv64	deb	noble	`2024.02-2ubuntu0.10`	Not reported	Not reported	Not reported
Ubuntu	edk2	deb	pro	`0~20191122.bd85bf54-2ubuntu3.6+esm1`	Not reported	USN-8865-1	Not reported
Ubuntu	edk2	deb	22.04	`2022.02-3ubuntu0.22.04.7`	Not reported	USN-8865-1	Not reported
Ubuntu	edk2	deb	24.04	`2024.02-2ubuntu0.10`	Not reported	USN-8865-1	Not reported
Ubuntu	edk2	deb	26.04	`2025.11-3ubuntu7.3`	Not reported	USN-8865-1	Not reported
Alpine	openssl	apk	3.22	`3.5.8-r0`	Not reported	ALPINE-CVE-2026-54874	Not reported
Alpine	openssl	apk	3.23	`3.5.8-r0`	Not reported	ALPINE-CVE-2026-54874	Not reported
Alpine	openssl	apk	3.24	`3.5.8-r0`	Not reported	ALPINE-CVE-2026-54874	Not reported
Suse	openssl-3	rpm	linux micro 6.1	`3.1.4-slfo.1.1_13.1`	Not reported	SUSE-SU-2026:23512-1	Not reported
Suse	openssl-3	rpm	linux micro 6.0	`3.1.4-17.1`	Not reported	SUSE-SU-2026:23473-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server 12 sp5-ltss	`1.1.1d-2.139.1`	Not reported	SUSE-SU-2026:4043-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server ltss extended security 12 sp5	`1.1.1d-2.139.1`	Not reported	SUSE-SU-2026:4043-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise module for basesystem 15 sp7	`1.1.1w-150700.11.30.1`	Not reported	SUSE-SU-2026:4041-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise module for development tools 15 sp7	`1.1.1w-150700.11.30.1`	Not reported	SUSE-SU-2026:4041-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise module for legacy 15 sp7	`1.1.1w-150700.11.30.1`	Not reported	SUSE-SU-2026:4041-1	Not reported
Suse	openssl-3	rpm	linux enterprise micro 5.3	`3.0.8-150400.4.98.1`	Not reported	SUSE-SU-2026:4032-1	Not reported
Suse	openssl-3	rpm	linux enterprise micro 5.4	`3.0.8-150400.4.98.1`	Not reported	SUSE-SU-2026:4032-1	Not reported
Suse	openssl-3	rpm	linux enterprise high performance computing 15 sp4-espos	`3.0.8-150400.4.98.1`	Not reported	SUSE-SU-2026:4032-1	Not reported
Suse	openssl-3	rpm	linux enterprise high performance computing 15 sp4-ltss	`3.0.8-150400.4.98.1`	Not reported	SUSE-SU-2026:4032-1	Not reported
Suse	openssl-3	rpm	linux enterprise server 15 sp4-ltss	`3.0.8-150400.4.98.1`	Not reported	SUSE-SU-2026:4032-1	Not reported
Suse	openssl-3	rpm	linux enterprise server for sap applications 15 sp4	`3.0.8-150400.4.98.1`	Not reported	SUSE-SU-2026:4032-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise micro 5.3	`1.1.1l-150400.7.104.1`	Not reported	SUSE-SU-2026:4033-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise micro 5.4	`1.1.1l-150400.7.104.1`	Not reported	SUSE-SU-2026:4033-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise high performance computing 15 sp4-espos	`1.1.1l-150400.7.104.1`	Not reported	SUSE-SU-2026:4033-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise high performance computing 15 sp4-ltss	`1.1.1l-150400.7.104.1`	Not reported	SUSE-SU-2026:4033-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server 15 sp4-ltss	`1.1.1l-150400.7.104.1`	Not reported	SUSE-SU-2026:4033-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server for sap applications 15 sp4	`1.1.1l-150400.7.104.1`	Not reported	SUSE-SU-2026:4033-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server 15 sp6-ltss	`1.1.1w-150600.5.38.1`	Not reported	SUSE-SU-2026:3878-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server for sap applications 15 sp6	`1.1.1w-150600.5.38.1`	Not reported	SUSE-SU-2026:3878-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise micro 5.5	`1.1.1l-150500.17.63.1`	Not reported	SUSE-SU-2026:3877-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise high performance computing 15 sp5-espos	`1.1.1l-150500.17.63.1`	Not reported	SUSE-SU-2026:3877-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise high performance computing 15 sp5-ltss	`1.1.1l-150500.17.63.1`	Not reported	SUSE-SU-2026:3877-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server 15 sp5-ltss	`1.1.1l-150500.17.63.1`	Not reported	SUSE-SU-2026:3877-1	Not reported
Suse	openssl-1_1	rpm	linux enterprise server for sap applications 15 sp5	`1.1.1l-150500.17.63.1`	Not reported	SUSE-SU-2026:3877-1	Not reported
Suse	openssl-3	rpm	linux enterprise high performance computing 15 sp5-espos	`3.0.8-150500.5.75.1`	Not reported	SUSE-SU-2026:3876-1	Not reported
Suse	openssl-3	rpm	linux enterprise high performance computing 15 sp5-ltss	`3.0.8-150500.5.75.1`	Not reported	SUSE-SU-2026:3876-1	Not reported
Suse	openssl-3	rpm	linux enterprise server 15 sp5-ltss	`3.0.8-150500.5.75.1`	Not reported	SUSE-SU-2026:3876-1	Not reported
Suse	openssl-3	rpm	linux enterprise server for sap applications 15 sp5	`3.0.8-150500.5.75.1`	Not reported	SUSE-SU-2026:3876-1	Not reported
Suse	openssl-3	rpm	linux enterprise server 15 sp6-ltss	`3.1.4-150600.5.64.1`	Not reported	SUSE-SU-2026:3866-1	Not reported
Suse	openssl-3	rpm	linux enterprise server for sap applications 15 sp6	`3.1.4-150600.5.64.1`	Not reported	SUSE-SU-2026:3866-1	Not reported
Ubuntu	openssl	deb	pro	`3.0.2-0ubuntu1.29+Fips1`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	edk2	deb	pro	`0~20191122.bd85bf54-2ubuntu3.6+esm1`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	openssl1.0	deb	pro	`1.0.2n-1ubuntu5.13+esm6`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	edk2	deb	22.04	`2022.02-3ubuntu0.22.04.7`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	openssl	deb	22.04	`3.0.2-0ubuntu1.29`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	openssl-fips	deb	pro	`3.0.13-0ubuntu3.15+Fips1`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	edk2	deb	24.04	`2024.02-2ubuntu0.10`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	openssl	deb	24.04	`3.0.13-0ubuntu3.15`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	edk2	deb	26.04	`2025.11-3ubuntu7.3`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Ubuntu	openssl	deb	26.04	`3.5.5-1ubuntu3.4`	Not reported	UBUNTU-CVE-2026-54874	Not reported
Suse	openssl-1_0_0	rpm	linux enterprise server 12 sp5-ltss	`1.0.2p-3.115.1`	Not reported	SUSE-SU-2026:4762-1	Not reported
Suse	openssl-1_0_0	rpm	linux enterprise server ltss extended security 12 sp5	`1.0.2p-3.115.1`	Not reported	SUSE-SU-2026:4762-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libssl3]Unknown
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[libssl-dev]Unknown
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[libssl-doc]Unknown
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · all · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[openssl]Unknown
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Affected · Fixed: 3.0.22-1~deb12u1
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12

[Debian 13 (Trixie)]

[libssl3t64]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
[libssl-dev]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
[libssl-doc]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · all · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · all · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
[openssl]Unknown
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
[openssl-provider-fips]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
[openssl-provider-legacy]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u2
  nvd · openssl · debian · 13

Observed: Oct 23, 2026, 9:37:03 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]