Denial of Service Vulnerability in OpenSSL Affecting RSA-OAEP Encryption

CVE-2026-28390

What is CVE-2026-28390?

A vulnerability exists in OpenSSL where processing a specially crafted CMS EnvelopedData message using KeyTransportRecipientInfo can lead to a NULL pointer dereference. This occurs when the parameters field of the RSA-OAEP algorithm identifier is checked without ensuring its presence, causing applications that handle untrusted CMS data to crash. The vulnerability particularly affects applications invoking CMS_decrypt() on malicious input, potentially resulting in Denial of Service before any authentication or cryptographic operations can take place. The FIPS modules in versions 3.6, 3.5, 3.4, 3.3, and 3.0 remain unaffected by this issue.

References