SUSE-SU-2026:24133-1
Security update for openssl-3
Published Oct 9, 2026 · updated Oct 15, 2026
This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 9, 2026 · OSV.dev
Detected
This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS
Oct 15, 2026 · OSV.dev
Fix available
openssl-3 fixed in 3.1.4-159998.1.1
Oct 15, 2026 · OSV.dev
Fix available
openssl-3 fixed in 3.1.4-159998.1.1
Oct 15, 2026 · OSV.dev
Updated
This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS
Affected
- SUSE:Linux Micro 6.0 openssl-30 → 3.1.4-159998.1.1