Sensitive Data Leakage in OpenSSL Affected by RSASVE Key Encapsulation

CVE-2026-31790

What is CVE-2026-31790?

Applications using RSA key encapsulation in OpenSSL may inadvertently expose sensitive data due to uninitialized memory buffers. Specifically, if EVP_PKEY_encapsulate() is called with an invalid RSA public key without prior validation, stale data from previous executions might be sent to an attacker. This vulnerability emphasizes the importance of implementing EVP_PKEY_public_check() as a mitigation step to ensure that only valid keys are processed, thus safeguarding against potential data leaks.

References