CVE-2026-28388
published 2026-04-07CVE-2026-28388: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.06%
60.7th percentile
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which
leads to a Denial of Service for an application.
When CRL processing and delta CRL processing is enabled during X.509
certificate verification, the delta CRL processing does not check
whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter
can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in
the verification context, the certificate being verified to contain a
freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and
an attacker to provide a malformed CRL to an application that processes it.
The vulnerability is limited to Denial of Service and cannot be escalated to
achieve code execution or memory disclosure. For that reason the issue was
assessed as Low severity according to our Security Policy.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the affected code is outside the OpenSSL FIPS module boundary.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.0.19-1~deb12u2 (bookworm) | openssl 3.0.19-1~deb12u2 (bookworm) |
| msrc | azl3_openssl_3.3.5-4_on_azure_linux_3.0 | — | — |
| openssl | openssl | >= 0 < 3.5.6-r0 | 3.5.6-r0 |
| openssl | openssl | >= 0 < 3.5.6-r0 | 3.5.6-r0 |
| openssl | openssl | >= 0 < 3.0.19-1~deb12u2 | 3.0.19-1~deb12u2 |
| openssl | openssl | >= 0 < 3.5.5-1~deb13u2 | 3.5.5-1~deb13u2 |
| openssl | openssl | >= 1.0.2 < 1.0.2zp | 1.0.2zp |
| openssl | openssl | >= 1.1.1 < 1.1.1zg | 1.1.1zg |
| openssl | openssl | >= 3.0.0 < 3.0.20 | 3.0.20 |
| openssl | openssl | >= 3.3.0 < 3.3.7 | 3.3.7 |
| openssl | openssl | >= 3.4.0 < 3.4.5 | 3.4.5 |
| openssl | openssl | >= 3.5.0 < 3.5.6 | 3.5.6 |
| openssl | openssl | >= 3.6.0 < 3.6.2 | 3.6.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
vendor_msrc5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.5
CVE-2026-28387 [HIGH] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
USN-8155-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for openssl and openssl1.0 packages for Ubuntu 14.04
LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
Viktor Dukhovni discovered that OpenSSL incorrectly negotiated the
expected preferred key exchange group when used as a TLS 1.3 server. This
could result in a less preferred key exchange being used, contrary to
expectations. This issue only affected Ubuntu 25.10. (CVE-2026-2673)
Igor Morgenstern discovered that OpenSSL incorrectly handled certain
memory operations when used as a DANE client. A remote attacker could use
this issue to cause OpenSSL to crash, resulting in
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2026-04-08·CVSS 7.5
CVE-2026-28388 [HIGH] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
Viktor Dukhovni discovered that OpenSSL incorrectly negotiated the expected
preferred key exchange group when used as a TLS 1.3 server. This could
result in a less preferred key exchange being used, contrary to
expectations. This issue only affected Ubuntu 25.10. (CVE-2026-2673)
Igor Morgenstern discovered that OpenSSL incorrectly handled certain memory
operations when used as a DANE client. A remote attacker could use this
issue to cause OpenSSL to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-28387)
Igor Morgenstern discovered that OpenSSL incorrectly handled certain memory
operations when processing a delta CRL. A remote attacker could possibly
use this iss
Red Hat
openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
vendor_redhat·2026-04-07·CVSS 7.5
CVE-2026-28388 [HIGH] CWE-476 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
A flaw was found in OpenSSL. When processing a malformed delta Certificate Revocation List (CRL) that lacks a required CRL Number extension, a NULL pointer dereference can occur. This vulnerability can be exploited by a remote attacker who provides a specially crafted delta CRL to an application that has delta CRL processing enabled, leading to a Denial of Service (DoS) for the application.
Statement: Low impact. This vulnerability in X.509 certificate verification can lead to a Denial of Service (DoS) due to a NULL pointer dereference when processing a malformed delta Certificate Revocation List (CRL). Exploitation requires the `X509_V_FLAG_USE_DELTAS` flag to be enabled in the verification conte
Microsoft
NULL Pointer Dereference When Processing a Delta CRL
vendor_msrc·2026-04-02·CVSS 5.9
CVE-2026-28388 [HIGH] CWE-476 NULL Pointer Dereference When Processing a Delta CRL
NULL Pointer Dereference When Processing a Delta CRL
Mariner: Mariner
openssl: openssl
Customer Action Required: Yes
Debian
CVE-2026-28388: openssl - Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is...
vendor_debian·2026·CVSS 7.5
CVE-2026-28388 [HIGH] CVE-2026-28388: openssl - Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is...
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base C
VulDB
OpenSSL up to 3.6.1 Delta CRL null pointer dereference (EUVD-2026-19962 / Nessus ID 305682)
vuldb·2026-05-02·CVSS 7.5
CVE-2026-28388 [HIGH] OpenSSL up to 3.6.1 Delta CRL null pointer dereference (EUVD-2026-19962 / Nessus ID 305682)
A vulnerability identified as problematic has been detected in OpenSSL up to 3.6.1. This impacts an unknown function of the component Delta CRL Handler. This manipulation causes null pointer dereference.
This vulnerability appears as CVE-2026-28388. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
GHSA
GHSA-rpg5-467j-c25q: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
ghsa_unreviewed·2026-04-08
CVE-2026-28388 CWE-476 GHSA-rpg5-467j-c25q: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which
leads to a Denial of Service for an application.
When CRL processing and delta CRL processing is enabled during X.509
certificate verification, the delta CRL processing does not check
whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter
can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in
the verification context, the certificate being verified to contain a
freshestCRL extension or the bas
OSV
CVE-2026-28388: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL
osv·2026-04-07·CVSS 7.5
CVE-2026-28388 [HIGH] CVE-2026-28388: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base C
OSV
CVE-2026-28388: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
osv·2026-04-07·CVSS 7.5
CVE-2026-28388 [HIGH] CVE-2026-28388: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which
leads to a Denial of Service for an application.
When CRL processing and delta CRL processing is enabled during X.509
certificate verification, the delta CRL processing does not check
whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter
can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in
the verification context, the certificate being verified to contain a
freshestCRL extension or the bas
OSV
CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL
osv·2026-04-07·CVSS 7.5
CVE-2026-28388 [HIGH] CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL
NULL Pointer Dereference When Processing a Delta CRL
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-28388 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-28388 [HIGH] CVE-2026-28388 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28388 :
OpenSSL vulnerability analysis and mitigation
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which
leads to a Denial of Service for an application.
When CRL processing and delta CRL processing is enabled during X.509
certificate verification, the delta CRL processing does not check
whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter
can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in
the verification context, the cert
Wiz
CVE-2026-28386 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.1
CVE-2026-28386 [CRITICAL] CVE-2026-28386 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28386 :
OpenSSL vulnerability analysis and mitigation
Issue summary: Applications using AES-CFB128 encryption or decryption on
systems with AVX-512 and VAES support can trigger an out-of-bounds read
of up to 15 bytes when processing partial cipher blocks.
Impact summary: This out-of-bounds read may trigger a crash which leads to
Denial of Service for an application if the input buffer ends at a memory
page boundary and the following page is unmapped. There is no information
disclosure as the over-read bytes are not written to output.
The vulnerable code path is only reached when processing partial blocks
(when a previous call left an incomplete block and the current call provides
fewer bytes than needed to complete it). Additionally, the input buffer
must be positioned at a
Wiz
CVE-2026-28387 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-28387 CVE-2026-28387 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28387 :
OpenSSL vulnerability analysis and mitigation
Issue summary: An uncommon configuration of clients performing DANE TLSA-based
server authentication, when paired with uncommon server DANE TLSA records, may
result in a use-after-free and/or double-free on the client side.
Impact summary: A use after free can have a range of potential consequences
such as the corruption of valid data, crashes or execution of arbitrary code.
However, the issue only affects clients that make use of TLSA records with both
the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate
usage.
By far the most common deployment of DANE is in SMTP MTAs for which RFC7672
recommends that clients treat as 'unusable' any TLSA records that have the PKIX
certificate usages. These SMTP (o
Wiz
CVE-2026-28389 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-28389 [HIGH] CVE-2026-28389 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28389 :
OpenSSL vulnerability analysis and mitigation
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier
is examined without checking for its presence. This results in a NULL
pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.
Wiz
CVE-2026-28390 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-28390 [HIGH] CVE-2026-28390 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28390 :
OpenSSL vulnerability analysis and mitigation
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with
RSA-OAEP encryption is processed, the optional parameters field of
RSA-OAEP SourceFunc algorithm identifier is examined without checking
for its presence. This results in a NULL pointer dereference if the field
is missing.
Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are
Wiz
CVE-2026-31789 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-31789 CVE-2026-31789 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31789 :
OpenSSL vulnerability analysis and mitigation
Issue summary: Converting an excessively large OCTET STRING value to
a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.
Impact summary: A heap buffer overflow may lead to a crash or possibly
an attacker controlled code execution or other undefined behavior.
If an attacker can supply a crafted X.509 certificate with an excessively
large OCTET STRING value in extensions such as the Subject Key Identifier
(SKID) or Authority Key Identifier (AKID) which are being converted to hex,
the size of the buffer needed for the result is calculated as multiplication
of the input length by 3. On 32 bit platforms, this multiplication may overflow
resulting in the allocation of a smaller buffer and a heap buffer ov
Wiz
CVE-2026-5190 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-5190 [HIGH] CVE-2026-5190 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-5190 :
Linux openSUSE vulnerability analysis and mitigation
Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages.
To remediate this issue, users should upgrade to version 0.6.0 or later.
Source : NVD
## 7.7
Score
Published March 31, 2026
Severity HIGH
CNA Score 7.7
Affected Technologies
Linux openSUSE
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
aws-c-event-stream-devel
libaws-c-event-
Wiz
CVE-2026-31790 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-31790 [HIGH] CVE-2026-31790 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31790 :
OpenSSL vulnerability analysis and mitigation
Issue summary: Applications using RSASVE key encapsulation to establish
a secret encryption key can send contents of an uninitialized memory buffer to
a malicious peer.
Impact summary: The uninitialized buffer might contain sensitive data from the
previous execution of the application process which leads to sensitive data
leakage to an attacker.
RSA_public_encrypt() returns the number of bytes written on success and -1
on error. The affected code tests only whether the return value is non-zero.
As a result, if RSA encryption fails, encapsulation can still return success to
the caller, set the output lengths, and leave the caller to use the contents of
the ciphertext buffer as if a valid KEM ciphertext had been produced.
Bugzilla
CVE-2026-28388 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
bugzilla·2026-03-25·CVSS 7.5
CVE-2026-28388 [HIGH] CVE-2026-28388 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
CVE-2026-28388 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension
is processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
Impact summary: A NULL pointer dereference can trigger a crash which
leads to a Denial of Service for an application.
When CRL processing and delta CRL processing is enabled during X.509
certificate verification, the delta CRL processing does not check
whether the CRL Number extension is NULL before dereferencing it.
When a malformed delta CRL file is being processed, this parameter
can be NULL, causing a NULL pointer dereference.
Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabl
https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2ehttps://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726https://openssl-library.org/news/secadv/20260407.txthttps://cert-portal.siemens.com/productcert/html/ssa-032379.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html
2026-04-07
Published