SUSE-SU-2026:4039-1: important: Security update for openssl-3
SLE-SECURITY-UPDATES
null at suse.de
Mon Sep 7 20:44:10 UTC 2026
# Security update for openssl-3
Announcement ID: SUSE-SU-2026:4039-1
Release Date: 2026-09-07T08:29:22Z
Rating: important
References:
* bsc#1266343
* bsc#1274774
* bsc#1274777
* bsc#1274788
* bsc#1274790
* bsc#1274791
* bsc#1274792
* bsc#1274795
* bsc#1274796
* bsc#1274797
* bsc#1274798
* bsc#1275837
Cross-References:
* CVE-2026-14456
* CVE-2026-14457
* CVE-2026-18798
* CVE-2026-34181
* CVE-2026-54874
* CVE-2026-63072
* CVE-2026-63073
* CVE-2026-63074
* CVE-2026-63075
* CVE-2026-63076
* CVE-2026-75803
CVSS scores:
* CVE-2026-14456 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-14456 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-14457 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-14457 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-18798 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-18798 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-34181 ( SUSE ): 2.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-34181 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-34181 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-54874 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-54874 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63072 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-63072 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63073 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-63073 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-63074 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-63074 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63075 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-63075 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63076 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-63076 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-75803 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-75803 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:
* Basesystem Module 15-SP7
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
An update that solves 11 vulnerabilities and has one security fix can now be
installed.
## Description:
This update for openssl-3 fixes the following issues:
August 2026 release.
* CVE-2026-14456: unbounded memory growth in QUIC server incoming channel
queue (bsc#1274791).
* CVE-2026-14457: RPK server signature algorithm selection can dereference a
missing certificate (bsc#1274792).
* CVE-2026-18798: QUIC server may trigger double free when processing INITIAL
packet (bsc#1274777).
* CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys
(bsc#1266343).
* CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future
Epoch (bsc#1274795).
* CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
* CVE-2026-63073: untrusted sender DN used as format string in CMP response
validation (bsc#1274796).
* CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
* CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion
(bsc#1274798).
* CVE-2026-63076: invalid pointer dereference in CMP server via crafted
`protectionAlg` (bsc#1274790).
* CVE-2026-75803: AEAD forgeries with empty ciphertext when using
`EVP_Cipher()` (bsc#1275837).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-4039=1
## Package List:
* Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* libopenssl3-3.5.0-150700.5.50.1
* openssl-3-debuginfo-3.5.0-150700.5.50.1
* openssl-3-3.5.0-150700.5.50.1
* libopenssl-3-fips-provider-debuginfo-3.5.0-150700.5.50.1
* openssl-3-debugsource-3.5.0-150700.5.50.1
* libopenssl3-debuginfo-3.5.0-150700.5.50.1
* libopenssl-3-devel-3.5.0-150700.5.50.1
* libopenssl-3-fips-provider-3.5.0-150700.5.50.1
* Basesystem Module 15-SP7 (x86_64)
* libopenssl-3-fips-provider-32bit-3.5.0-150700.5.50.1
* libopenssl3-32bit-3.5.0-150700.5.50.1
* libopenssl3-32bit-debuginfo-3.5.0-150700.5.50.1
* libopenssl-3-fips-provider-32bit-debuginfo-3.5.0-150700.5.50.1
## References:
* https://www.suse.com/security/cve/CVE-2026-14456.html
* https://www.suse.com/security/cve/CVE-2026-14457.html
* https://www.suse.com/security/cve/CVE-2026-18798.html
* https://www.suse.com/security/cve/CVE-2026-34181.html
* https://www.suse.com/security/cve/CVE-2026-54874.html
* https://www.suse.com/security/cve/CVE-2026-63072.html
* https://www.suse.com/security/cve/CVE-2026-63073.html
* https://www.suse.com/security/cve/CVE-2026-63074.html
* https://www.suse.com/security/cve/CVE-2026-63075.html
* https://www.suse.com/security/cve/CVE-2026-63076.html
* https://www.suse.com/security/cve/CVE-2026-75803.html
* https://bugzilla.suse.com/show_bug.cgi?id=1266343
* https://bugzilla.suse.com/show_bug.cgi?id=1274774
* https://bugzilla.suse.com/show_bug.cgi?id=1274777
* https://bugzilla.suse.com/show_bug.cgi?id=1274788
* https://bugzilla.suse.com/show_bug.cgi?id=1274790
* https://bugzilla.suse.com/show_bug.cgi?id=1274791
* https://bugzilla.suse.com/show_bug.cgi?id=1274792
* https://bugzilla.suse.com/show_bug.cgi?id=1274795
* https://bugzilla.suse.com/show_bug.cgi?id=1274796
* https://bugzilla.suse.com/show_bug.cgi?id=1274797
* https://bugzilla.suse.com/show_bug.cgi?id=1274798
* https://bugzilla.suse.com/show_bug.cgi?id=1275837
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260907/361dcf35/attachment-0001.htm>
More information about the sle-security-updates
mailing list