UpHeron
All vulnerabilities

Servers and applications

CVE-2026-22796

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the…

Severity
Medium 5.3
Published
27 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 3.6.0 before 3.6.1
  • From 3.5.0 before 3.5.5
  • From 3.4.0 before 3.4.4
  • From 3.3.0 before 3.3.6
All 7 release lines
  • From 1.0.2 before 1.0.2zn
  • From 1.1.1 before 1.1.1ze
  • From 3.0.0 before 3.0.19
  • From 3.3.0 before 3.3.6
  • From 3.4.0 before 3.4.4
  • From 3.5.0 before 3.5.5
  • From 3.6.0 before 3.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-22796
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-22796