UpHeron
All vulnerabilities

Servers and applications

CVE-2026-72897

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A…

Severity
High 7.5
Published
29 Sept 2026
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.4.8, 3.5.9, 3.6.5, 4.0.3
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 3.4.0 before 3.4.8
  • From 3.5.0 before 3.5.9
  • From 3.6.0 before 3.6.5
  • From 4.0.0 before 4.0.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-72897
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-72897