Use-after-free Vulnerability in OpenSSL Products Related to DANE TLSA Records

CVE-2026-28387

What is CVE-2026-28387?

An uncommon configuration involving clients that perform DANE TLSA-based server authentication can result in a use-after-free and double-free vulnerability. This issue occurs when clients connect to a server that publishes TLSA records using both PKIX-TA(0/PKIX-EE(1) and DANE-TA(2) certificate usages. Although this is a rare scenario, it may lead to data corruption, application crashes, or the execution of arbitrary code. Most standard deployments, particularly in SMTP MTAs, mitigate this risk by ignoring TLSA records with PKIX usages, making those clients safe from this vulnerability. FIPS modules remain unaffected as the problematic code lies outside the FIPS boundary.

References