CVE-2026-28387

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28387
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28387.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28387
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (22)
CLSA (10)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
MINI (3)
OESA (12)
openSUSE (2)
RHSA (1)
ROOT (3)
SUSE (16)
UBUNTU (1)
Related
openSUSE (2)
SUSE (16)
Published
2026-04-07T22:00:51Z
Modified
2026-11-11T13:30:31Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Potential Use-after-free in DANE Client Code
Details

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

Database specific 
{
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28387.json"
}
References

Affected packages

Git / github.com/kzalewski/openssl-1.1.1

Affected ranges

Type
GIT
Repo
https://github.com/kzalewski/openssl-1.1.1
Events
Introduced
9ad69b994ae7c73ba06d9f75efd2625102de814c
Fixed
9ad69b994ae7c73ba06d9f75efd2625102de814c
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "fixed": "1.1.1zg"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
e04bd3433fd84e1861bf258ea37928d9845e6a86
Fixed
e04bd3433fd84e1861bf258ea37928d9845e6a86
Introduced
89cd17a031e022211684eb7eb41190cf1910f9fa
Fixed
5aada9c299a3b28fc82348f4e2b93805fa0a0e9c
Introduced
4cb31128b5790819dfeea2739fbde265f71a10a2
Fixed
204165c1550d3aa0f49395af654124cec2bbabf9
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
03b8620d6e9b7b4d5701865edb6ad86101fe5517
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
286ddeaac037533bbdce65b3c689e3f7ffebf0f6
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
fe686e15d84334b284f883118ed92f64b409b3aa
Fixed
07e727d304746edb49a98ee8f6ab00256e1f012b
Fixed
258a8f63b26995ba357f4326da00e19e29c6acbe
Fixed
444958deaf450aea819171f97ae69eaedede42c3
Fixed
7a4e08cee62a728d32e60b0de89e6764339df0a7
Fixed
ec03fa050b3346997ed9c5fef3d0e16ad7db8177
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "fixed": "1.1.1zg"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.0.20"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.7"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "3.6.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "07e727d304746edb49a98ee8f6ab00256e1f012b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "258a8f63b26995ba357f4326da00e19e29c6acbe"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "444958deaf450aea819171f97ae69eaedede42c3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "7a4e08cee62a728d32e60b0de89e6764339df0a7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ec03fa050b3346997ed9c5fef3d0e16ad7db8177"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0-POST-CLANG-FORMAT-WEBKIT
3.0-PRE-CLANG-FORMAT-WEBKIT
3.3-POST-CLANG-FORMAT-WEBKIT
3.3-PRE-CLANG-FORMAT-WEBKIT
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.0.0
openssl-3.0.1
openssl-3.0.10
openssl-3.0.11
openssl-3.0.12
openssl-3.0.13
openssl-3.0.14
openssl-3.0.15
openssl-3.0.16
openssl-3.0.17
openssl-3.0.18
openssl-3.0.19
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8
openssl-3.0.9
openssl-3.3.0
openssl-3.3.1
openssl-3.3.2
openssl-3.3.3
openssl-3.3.4
openssl-3.3.5
openssl-3.3.6
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.6.0
openssl-3.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28387.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "42797208737688127763066522181332281160",
            "length": 507
        },
        "id": "CVE-2026-28387-17161750",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "test/ec_internal_test.c",
            "function": "setup_tests"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283256969903938989772123552139503656521",
                "53327457579658961766639476624151656339",
                "32732054683813575878738806870762304893",
                "207246611003871476096410016377987837353"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-209d55f4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7",
        "target": {
            "file": "crypto/x509/x509_vfy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "230361427007416664995616424352791763469",
                "68454496777232705137616949383570055801",
                "174227485603324825134703660955423564225",
                "306374039697804480350160125378658725435",
                "223787537721903344733141597182001711142",
                "305852724676774806958748002571762917320",
                "61902118637910596077004663207701223681",
                "278724473247779637198513168995006009135",
                "150804929727413209120953746872414715465",
                "166774358343717215765245239236385866693",
                "116293081894868411264108492273509366961",
                "326496170417124709669304286305887789679",
                "278306348133167756990680493182074324125",
                "189649085256091224929149730235838635518",
                "82945606976757935725900546138315651129",
                "136187505923069729147869676886657763243",
                "233447734599456461300796481665382809870",
                "116930820689846462220149337293161556595",
                "153181275943870954612030432229689150702",
                "65985025876624501603393736976041980125"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-3349f255",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "crypto/bn/bn_gf2m.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "30673062630639656303483208802482655434",
            "length": 494
        },
        "id": "CVE-2026-28387-4f7f516c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "crypto/bn/bn_gf2m.c",
            "function": "BN_GF2m_poly2arr"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283256969903938989772123552139503656521",
                "53327457579658961766639476624151656339",
                "32732054683813575878738806870762304893",
                "207246611003871476096410016377987837353"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-ba6575d0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177",
        "target": {
            "file": "crypto/x509/x509_vfy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-c377fa22",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "target": {
            "file": "include/openssl/opensslv.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "200741635241403915506169986875397762234",
                "311067311993699218696043159967386251598",
                "43026770684935214297188139889092606454",
                "130682816136045047551312796150974503954"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-d180d07d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3",
        "target": {
            "file": "crypto/x509/x509_vfy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "202560716467995180801900703314012126638",
                "231076714992210239911677876085986544653",
                "119476550149019858610160764241585512883",
                "237713134421560846878241190267682686452",
                "291912177671523663250360670212314966717",
                "148718397703357758449784276736258891876",
                "8308956487359903771982894414540058331",
                "219665286569007368979236427780197060159"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-f19f6747",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "test/ec_internal_test.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283256969903938989772123552139503656521",
                "53327457579658961766639476624151656339",
                "32732054683813575878738806870762304893",
                "207246611003871476096410016377987837353"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-f1e9abfd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b",
        "target": {
            "file": "crypto/x509/x509_vfy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "200741635241403915506169986875397762234",
                "311067311993699218696043159967386251598",
                "43026770684935214297188139889092606454",
                "130682816136045047551312796150974503954"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-fa7d59d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe",
        "target": {
            "file": "crypto/x509/x509_vfy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "215474658839038190857768659117172798903",
                "224789752300883698945153787266757617261",
                "56494159630746388130037307952134413004",
                "164370382436795402003615230331141913984",
                "149153318460680570484795927015804201404"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28387-fa870959",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "include/openssl/opensslv.h"
        }
    }
]
vanir_signatures_modified 
"2026-11-11T13:30:31Z"