{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "OpenSSL: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/openssl--openssl/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/openssl--openssl/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 disclosed",
   "content_text": "Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Enterprise Server 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Enterprise Server for SAP applications 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Micro 6.2",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Ubuntu:22.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.2-0ubuntu1.30.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Ubuntu:24.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.13-0ubuntu3.16.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.6.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84783/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84783/",
   "title": "CVE-2026-84783 disclosed",
   "content_text": "Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate's X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck",
   "date_published": "2026-09-29T15:32:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84783/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84783/",
   "title": "CVE-2026-84783 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.8-0.1.hum1, openssl-config-fips 0:3.5.8-0.1.hum1, openssl-devel 0:3.5.8-0.1.hum1, openssl-devel-engine 0:3.5.8-0.1.hum1, openssl-fips-provider-upstream 0:3.5.8-0.1.hum1, openssl-libs 0:3.5.8-0.1.hum1, openssl-perl 0:3.5.8-0.1.hum1, openssl3 0:3.5.8-1.hum1, openssl3-devel 0:3.5.8-1.hum1, openssl3-devel-engine 0:3.5.8-1.hum1, openssl3-libs 0:3.5.8-1.hum1.",
   "date_published": "2026-09-29T15:32:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 disclosed",
   "content_text": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/almalinux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in AlmaLinux:10",
   "content_text": "Fixed versions: openssl 1:3.5.8-2.el10_2.alma.1, openssl-devel 1:3.5.8-2.el10_2.alma.1, openssl-libs 1:3.5.8-2.el10_2.alma.1, openssl-perl 1:3.5.8-2.el10_2.alma.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/almalinux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in AlmaLinux:8",
   "content_text": "Fixed versions: compat-openssl10 1:1.0.2o-4.el8_10.4, openssl 1:1.1.1k-18.el8_6, openssl-devel 1:1.1.1k-18.el8_6, openssl-libs 1:1.1.1k-18.el8_6, openssl-perl 1:1.1.1k-18.el8_6.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/almalinux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in AlmaLinux:9",
   "content_text": "Fixed versions: compat-openssl11 1:1.1.1k-5.el9_8.6, openssl 1:3.5.8-2.el9_8, openssl-devel 1:3.5.8-2.el9_8, openssl-libs 1:3.5.8-2.el9_8, openssl-perl 1:3.5.8-2.el9_8.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-enterprise-linux-10.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:enterprise_linux:10.2",
   "content_text": "Fixed versions: openssl 1:3.5.8-2.el10_2, openssl-debuginfo 1:3.5.8-2.el10_2, openssl-debugsource 1:3.5.8-2.el10_2, openssl-devel 1:3.5.8-2.el10_2, openssl-libs 1:3.5.8-2.el10_2, openssl-libs-debuginfo 1:3.5.8-2.el10_2, openssl-perl 1:3.5.8-2.el10_2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-enterprise-linux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:enterprise_linux:8",
   "content_text": "Fixed versions: compat-openssl10 1:1.0.2o-4.el8_10.4, compat-openssl10-debuginfo 1:1.0.2o-4.el8_10.4, compat-openssl10-debugsource 1:1.0.2o-4.el8_10.4.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-enterprise-linux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:enterprise_linux:9",
   "content_text": "Fixed versions: compat-openssl11 1:1.1.1k-5.el9_8.6, compat-openssl11-debuginfo 1:1.1.1k-5.el9_8.6, compat-openssl11-debugsource 1:1.1.1k-5.el9_8.6, openssl 1:3.5.8-2.el9_8, openssl-debuginfo 1:3.5.8-2.el9_8, openssl-debugsource 1:3.5.8-2.el9_8, openssl-devel 1:3.5.8-2.el9_8, openssl-libs 1:3.5.8-2.el9_8, openssl-libs-debuginfo 1:3.5.8-2.el9_8, openssl-perl 1:3.5.8-2.el9_8.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: bootupd 0:0.3.2-1.hum1, chunkah 0:0.7.0-1.1.hum1, openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1, python-cryptography 0:50.0.0-1.hum1, python3-cryptography 0:50.0.0-1.hum1, ruby3.3 0:3.3.10-23.6.hum1, ruby3.3-bundled-gems 0:3.3.10-23.6.hum1, ruby3.3-default-gems 0:3.3.10-23.6.hum1, ruby3.3-devel 0:3.3.10-23.6.hum1, ruby3.3-doc 0:3.3.10-23.6.hum1, ruby3.3-libs 0:3.3.10-23.6.hum1, ruby3.4 0:3.4.10-31.7.hum1, ruby3.4-bundled-gems 0:3.4.10-31.7.hum1, ruby3.4-default-gems 0:3.4.10-31.7.hum1, ruby3.4-devel 0:3.4.10-31.7.hum1, ruby3.4-doc 0:3.4.10-31.7.hum1, ruby3.4-libs 0:3.4.10-31.7.hum1, rubygem3.3-bigdecimal 0:3.1.5-23.6.hum1, rubygem3.3-bundler 0:2.5.22-23.6.hum1, rubygem3.3-devel 0:3.5.22-23.6.hum1, rubygem3.3-io-console 0:0.7.1-23.6.hum1, rubygem3.3-irb 0:1.13.1-23.6.hum1, rubygem3.3-json 0:2.7.2-23.6.hum1, rubygem3.3-minitest 0:5.20.0-23.6.hum1, rubygem3.3-power_assert 0:2.0.3-23.6.hum1, rubygem3.3-psych 0:5.1.2-23.6.hum1, rubygem3.3-racc 0:1.7.3-23.6.hum1, rubygem3.3-rake 0:13.1.0-23.6.hum1, rubygem3.3-rbs 0:3.4.0-23.6.hum1, rubygem3.3-rdoc 0:6.6.3.1-23.6.hum1, rubygem3.3-rexml 0:3.4.4-23.6.hum1, rubygem3.3-rss 0:0.3.1-23.6.hum1, rubygem3.3-rubygems 0:3.5.22-23.6.hum1, rubygem3.3-test-unit 0:3.6.1-23.6.hum1, rubygem3.3-typeprof 0:0.21.9-23.6.hum1, rust-bootupd 0:0.3.2-1.hum1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/rocky-linux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Rocky Linux:10",
   "content_text": "Fixed versions: openssl 1:3.5.8-2.el10_2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/rocky-linux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Rocky Linux:8",
   "content_text": "Fixed versions: compat-openssl10 1:1.0.2o-4.el8_10.4.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/rocky-linux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Rocky Linux:9",
   "content_text": "Fixed versions: compat-openssl11 1:1.1.1k-5.el9_8.6, openssl 1:3.5.8-2.el9_8.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-live-patching-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Live Patching 15 SP6",
   "content_text": "Fixed versions: openssl-3-livepatches 0.7-150600.13.22.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-live-patching-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Live Patching 15 SP7",
   "content_text": "Fixed versions: openssl-3-livepatches 0.7-150700.16.15.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Micro 5.3",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Micro 5.4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 15 SP6-LTSS",
   "content_text": "Fixed versions: openssl-3 3.1.4-150600.5.67.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP5",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP6",
   "content_text": "Fixed versions: openssl-3 3.1.4-150600.5.67.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP applications 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Micro 6.0",
   "content_text": "Fixed versions: openssl-3 3.1.4-159998.1.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Micro 6.2",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:22.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.2-0ubuntu1.30.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:24.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.13-0ubuntu3.16.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.6.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:14.04:LTS",
   "content_text": "Fixed versions: openssl 1.0.1f-1ubuntu2.27+esm17.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:16.04:LTS",
   "content_text": "Fixed versions: openssl 1.0.2g-1ubuntu4.20+esm19.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:18.04:LTS",
   "content_text": "Fixed versions: openssl 1.1.1-1ubuntu2.1~18.04.23+esm11, openssl1.0 1.0.2n-1ubuntu5.13+esm7.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:20.04:LTS",
   "content_text": "Fixed versions: openssl 1.1.1f-1ubuntu2.24+esm6.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 disclosed",
   "content_text": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in SUSE:Linux Enterprise Server 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in SUSE:Linux Enterprise Server for SAP applications 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in SUSE:Linux Micro 6.2",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Ubuntu:22.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.2-0ubuntu1.30.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Ubuntu:24.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.13-0ubuntu3.16.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-72897/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-72897/",
   "title": "CVE-2026-72897 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.6.",
   "date_published": "2026-09-29T15:32:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-54873/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-54873/",
   "title": "CVE-2026-54873 disclosed",
   "content_text": "Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.",
   "date_published": "2026-09-29T15:32:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-54873/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-54873/",
   "title": "CVE-2026-54873 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-54873/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-54873/",
   "title": "CVE-2026-54873 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-54873/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-54873/",
   "title": "CVE-2026-54873 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1.",
   "date_published": "2026-09-29T15:32:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-54873/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-54873/",
   "title": "CVE-2026-54873 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.7.",
   "date_published": "2026-09-29T15:32:16Z"
  }
 ]
}