CVE-2026-28389

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28389
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28389.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28389
Downstream
ALPINE (1)
AZL (3)
BELL (1)
CGA (24)
CLSA (14)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
MINI (3)
OESA (10)
openSUSE (2)
RHSA (1)
ROOT (2)
SUSE (18)
UBUNTU (1)
Related
openSUSE (2)
SUSE (18)
Published
2026-04-07T22:00:53Z
Modified
2026-11-11T13:22:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
Details

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Database specific 
{
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28389.json"
}
References

Affected packages

Git / github.com/alsyundawy/openssl-1.0.2

Affected ranges

Type
GIT
Repo
https://github.com/alsyundawy/openssl-1.0.2
Events
Introduced
c46078156d49453ba69badc9addb1e2dcd1c71f5
Fixed
c46078156d49453ba69badc9addb1e2dcd1c71f5
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.2"
                },
                {
                    "fixed": "1.0.2zp"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/kzalewski/openssl-1.1.1
Events
Introduced
9ad69b994ae7c73ba06d9f75efd2625102de814c
Fixed
9ad69b994ae7c73ba06d9f75efd2625102de814c
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "fixed": "1.1.1zg"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
e818b74be2170fbe957a07b0da4401c2b694b3b8
Fixed
e818b74be2170fbe957a07b0da4401c2b694b3b8
Introduced
e04bd3433fd84e1861bf258ea37928d9845e6a86
Fixed
e04bd3433fd84e1861bf258ea37928d9845e6a86
Introduced
89cd17a031e022211684eb7eb41190cf1910f9fa
Fixed
5aada9c299a3b28fc82348f4e2b93805fa0a0e9c
Introduced
4cb31128b5790819dfeea2739fbde265f71a10a2
Fixed
204165c1550d3aa0f49395af654124cec2bbabf9
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
03b8620d6e9b7b4d5701865edb6ad86101fe5517
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
286ddeaac037533bbdce65b3c689e3f7ffebf0f6
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
fe686e15d84334b284f883118ed92f64b409b3aa
Fixed
16cea4188e0ea567deb4f93f85902247e67384f5
Fixed
785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616
Fixed
7b5274e812400cacb6f3be4c2df5340923fa807f
Fixed
c6725634e089eb2b634b10ede33944be7248172a
Fixed
f80f83bc5fd036bc47d773e8b15a001e2b4ce686
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.2"
                },
                {
                    "fixed": "1.0.2zp"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "fixed": "1.1.1zg"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.0.20"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.7"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "3.6.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "16cea4188e0ea567deb4f93f85902247e67384f5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "7b5274e812400cacb6f3be4c2df5340923fa807f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "c6725634e089eb2b634b10ede33944be7248172a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "f80f83bc5fd036bc47d773e8b15a001e2b4ce686"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0-POST-CLANG-FORMAT-WEBKIT
3.0-PRE-CLANG-FORMAT-WEBKIT
3.3-POST-CLANG-FORMAT-WEBKIT
3.3-PRE-CLANG-FORMAT-WEBKIT
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.0.0
openssl-3.0.1
openssl-3.0.10
openssl-3.0.11
openssl-3.0.12
openssl-3.0.13
openssl-3.0.14
openssl-3.0.15
openssl-3.0.16
openssl-3.0.17
openssl-3.0.18
openssl-3.0.19
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8
openssl-3.0.9
openssl-3.3.0
openssl-3.3.1
openssl-3.3.2
openssl-3.3.3
openssl-3.3.4
openssl-3.3.5
openssl-3.3.6
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.6.0
openssl-3.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28389.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "220212300272990662700643768678357463760",
            "length": 1363
        },
        "id": "CVE-2026-28389-08261dff",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5",
        "target": {
            "file": "crypto/cms/cms_ec.c",
            "function": "ecdh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "42797208737688127763066522181332281160",
            "length": 507
        },
        "id": "CVE-2026-28389-17161750",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "test/ec_internal_test.c",
            "function": "setup_tests"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "35040822673859645981477916107913023139",
                "93565823115982767152496764659501767766",
                "241756499995554558550602367300017643700",
                "191338120555964314917981441313617292316",
                "147857528157518671552020408598352417501",
                "191712768671169977210748902842933264345",
                "285821873076905783592971116327398757227",
                "206703883280606155502738453870378980881",
                "335217870970338360093905925963042168197",
                "276006600787294503462210323054236244571",
                "86260100061005767582631828819609971143",
                "319381704718689333317669133590605303938",
                "256282953336782932349783315299183728680",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-1b1ca4d9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616",
        "target": {
            "file": "crypto/cms/cms_dh.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339574314018800471946332591302274221091",
                "324373727784504944843233301225824637211",
                "241756499995554558550602367300017643700",
                "12521850379814007373532789688046211438",
                "117342360621347706033129047703801997159",
                "185292036368172262462097254932521310241",
                "94190543996604676849176713917615421954",
                "106863008812326076345685972430007566832",
                "282378567138276691786629430182438473941",
                "255116467245818032153320742923067490257",
                "36986505605978595967335407833084821547",
                "149880329217016635387887804450489765326",
                "89860272611462147307771061494521213681",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-326533ff",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f",
        "target": {
            "file": "crypto/cms/cms_ec.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "230361427007416664995616424352791763469",
                "68454496777232705137616949383570055801",
                "174227485603324825134703660955423564225",
                "306374039697804480350160125378658725435",
                "223787537721903344733141597182001711142",
                "305852724676774806958748002571762917320",
                "61902118637910596077004663207701223681",
                "278724473247779637198513168995006009135",
                "150804929727413209120953746872414715465",
                "166774358343717215765245239236385866693",
                "116293081894868411264108492273509366961",
                "326496170417124709669304286305887789679",
                "278306348133167756990680493182074324125",
                "189649085256091224929149730235838635518",
                "82945606976757935725900546138315651129",
                "136187505923069729147869676886657763243",
                "233447734599456461300796481665382809870",
                "116930820689846462220149337293161556595",
                "153181275943870954612030432229689150702",
                "65985025876624501603393736976041980125"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-3349f255",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "crypto/bn/bn_gf2m.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "220212300272990662700643768678357463760",
            "length": 1363
        },
        "id": "CVE-2026-28389-33cf90c9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f",
        "target": {
            "file": "crypto/cms/cms_ec.c",
            "function": "ecdh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85580592443376971564746879996092594480",
            "length": 1634
        },
        "id": "CVE-2026-28389-4c6b9c04",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f",
        "target": {
            "file": "crypto/cms/cms_dh.c",
            "function": "dh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "30673062630639656303483208802482655434",
            "length": 494
        },
        "id": "CVE-2026-28389-4f7f516c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "crypto/bn/bn_gf2m.c",
            "function": "BN_GF2m_poly2arr"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "158952456200596267618838350065954804513",
                "93565823115982767152496764659501767766",
                "241756499995554558550602367300017643700",
                "191338120555964314917981441313617292316",
                "147857528157518671552020408598352417501",
                "191712768671169977210748902842933264345",
                "285821873076905783592971116327398757227",
                "206703883280606155502738453870378980881",
                "335217870970338360093905925963042168197",
                "276006600787294503462210323054236244571",
                "86260100061005767582631828819609971143",
                "319381704718689333317669133590605303938",
                "256282953336782932349783315299183728680",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-644f67bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686",
        "target": {
            "file": "crypto/cms/cms_dh.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "35040822673859645981477916107913023139",
                "93565823115982767152496764659501767766",
                "241756499995554558550602367300017643700",
                "191338120555964314917981441313617292316",
                "147857528157518671552020408598352417501",
                "191712768671169977210748902842933264345",
                "285821873076905783592971116327398757227",
                "206703883280606155502738453870378980881",
                "335217870970338360093905925963042168197",
                "276006600787294503462210323054236244571",
                "86260100061005767582631828819609971143",
                "319381704718689333317669133590605303938",
                "256282953336782932349783315299183728680",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-668111d0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a",
        "target": {
            "file": "crypto/cms/cms_dh.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85580592443376971564746879996092594480",
            "length": 1634
        },
        "id": "CVE-2026-28389-6770b983",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a",
        "target": {
            "file": "crypto/cms/cms_dh.c",
            "function": "dh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "220212300272990662700643768678357463760",
            "length": 1363
        },
        "id": "CVE-2026-28389-69d31ac9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a",
        "target": {
            "file": "crypto/cms/cms_ec.c",
            "function": "ecdh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85580592443376971564746879996092594480",
            "length": 1634
        },
        "id": "CVE-2026-28389-6f275edb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616",
        "target": {
            "file": "crypto/cms/cms_dh.c",
            "function": "dh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339574314018800471946332591302274221091",
                "324373727784504944843233301225824637211",
                "241756499995554558550602367300017643700",
                "12521850379814007373532789688046211438",
                "117342360621347706033129047703801997159",
                "185292036368172262462097254932521310241",
                "94190543996604676849176713917615421954",
                "106863008812326076345685972430007566832",
                "282378567138276691786629430182438473941",
                "255116467245818032153320742923067490257",
                "36986505605978595967335407833084821547",
                "149880329217016635387887804450489765326",
                "89860272611462147307771061494521213681",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-746edf00",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a",
        "target": {
            "file": "crypto/cms/cms_ec.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339574314018800471946332591302274221091",
                "324373727784504944843233301225824637211",
                "241756499995554558550602367300017643700",
                "12521850379814007373532789688046211438",
                "117342360621347706033129047703801997159",
                "185292036368172262462097254932521310241",
                "94190543996604676849176713917615421954",
                "106863008812326076345685972430007566832",
                "282378567138276691786629430182438473941",
                "255116467245818032153320742923067490257",
                "36986505605978595967335407833084821547",
                "149880329217016635387887804450489765326",
                "89860272611462147307771061494521213681",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-7569978c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616",
        "target": {
            "file": "crypto/cms/cms_ec.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "220212300272990662700643768678357463760",
            "length": 1363
        },
        "id": "CVE-2026-28389-7b09eb19",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686",
        "target": {
            "file": "crypto/cms/cms_ec.c",
            "function": "ecdh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339574314018800471946332591302274221091",
                "324373727784504944843233301225824637211",
                "241756499995554558550602367300017643700",
                "12521850379814007373532789688046211438",
                "117342360621347706033129047703801997159",
                "185292036368172262462097254932521310241",
                "94190543996604676849176713917615421954",
                "106863008812326076345685972430007566832",
                "282378567138276691786629430182438473941",
                "255116467245818032153320742923067490257",
                "36986505605978595967335407833084821547",
                "149880329217016635387887804450489765326",
                "89860272611462147307771061494521213681",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-9a894a5a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5",
        "target": {
            "file": "crypto/cms/cms_ec.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "35040822673859645981477916107913023139",
                "93565823115982767152496764659501767766",
                "241756499995554558550602367300017643700",
                "191338120555964314917981441313617292316",
                "147857528157518671552020408598352417501",
                "191712768671169977210748902842933264345",
                "285821873076905783592971116327398757227",
                "206703883280606155502738453870378980881",
                "335217870970338360093905925963042168197",
                "276006600787294503462210323054236244571",
                "86260100061005767582631828819609971143",
                "319381704718689333317669133590605303938",
                "256282953336782932349783315299183728680",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-a2c81bc9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5",
        "target": {
            "file": "crypto/cms/cms_dh.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339574314018800471946332591302274221091",
                "324373727784504944843233301225824637211",
                "241756499995554558550602367300017643700",
                "12521850379814007373532789688046211438",
                "117342360621347706033129047703801997159",
                "185292036368172262462097254932521310241",
                "94190543996604676849176713917615421954",
                "106863008812326076345685972430007566832",
                "282378567138276691786629430182438473941",
                "255116467245818032153320742923067490257",
                "36986505605978595967335407833084821547",
                "149880329217016635387887804450489765326",
                "89860272611462147307771061494521213681",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-a8c14aef",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686",
        "target": {
            "file": "crypto/cms/cms_ec.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "220212300272990662700643768678357463760",
            "length": 1363
        },
        "id": "CVE-2026-28389-b3d14555",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616",
        "target": {
            "file": "crypto/cms/cms_ec.c",
            "function": "ecdh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-c377fa22",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "target": {
            "file": "include/openssl/opensslv.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85580592443376971564746879996092594480",
            "length": 1634
        },
        "id": "CVE-2026-28389-c7d767cf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686",
        "target": {
            "file": "crypto/cms/cms_dh.c",
            "function": "dh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "35040822673859645981477916107913023139",
                "93565823115982767152496764659501767766",
                "241756499995554558550602367300017643700",
                "191338120555964314917981441313617292316",
                "147857528157518671552020408598352417501",
                "191712768671169977210748902842933264345",
                "285821873076905783592971116327398757227",
                "206703883280606155502738453870378980881",
                "335217870970338360093905925963042168197",
                "276006600787294503462210323054236244571",
                "86260100061005767582631828819609971143",
                "319381704718689333317669133590605303938",
                "256282953336782932349783315299183728680",
                "10137784562806207999599328005914036118",
                "23908226079055335692986235745925339697"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-dbb50246",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f",
        "target": {
            "file": "crypto/cms/cms_dh.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "251633914150035957322733061977107206211",
                "338514574181828579838011565939158652696",
                "76638288692106140328510055542557597351",
                "142922657400765574308962710386922248045",
                "71649992455794854055653842592139575350",
                "65527166711110472566013424527579064967",
                "253196866009476977787139000804413898733",
                "172177136897997206866313011107384691461"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-e051451f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8",
        "target": {
            "file": "crypto/opensslv.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85580592443376971564746879996092594480",
            "length": 1634
        },
        "id": "CVE-2026-28389-e38dd840",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5",
        "target": {
            "file": "crypto/cms/cms_dh.c",
            "function": "dh_cms_set_shared_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "202560716467995180801900703314012126638",
                "231076714992210239911677876085986544653",
                "119476550149019858610160764241585512883",
                "237713134421560846878241190267682686452",
                "291912177671523663250360670212314966717",
                "148718397703357758449784276736258891876",
                "8308956487359903771982894414540058331",
                "219665286569007368979236427780197060159"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-f19f6747",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "test/ec_internal_test.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "215474658839038190857768659117172798903",
                "224789752300883698945153787266757617261",
                "56494159630746388130037307952134413004",
                "164370382436795402003615230331141913984",
                "149153318460680570484795927015804201404"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-28389-fa870959",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
        "target": {
            "file": "include/openssl/opensslv.h"
        }
    }
]
vanir_signatures_modified 
"2026-11-11T13:22:00Z"