> CVE-2026-34182

« BACK_TO_HOME
PUBLISHED
2026-06-09 17:17
MODIFIED
2026-06-09 17:17
EPSS (Prob. Exploit)
1.06%
Top 35.5%
DATA SOURCES:
NVD 🔗 2026-06-09 RED HAT 🔗 2026-06-14 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 OSV 🔗 2026-11-02 MSRC 🔗 2026-11-02

> DESCRIPTION

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success. If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules are not affected by this issue.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 3.5.5
Red Hat - Red Hat Enterprise Linux 9
Version: 3.5.5

> WEAKNESSES

CWE-354

> CWE DETAILED DESCRIPTIONS

CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update
The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
A Subscription Management tool for finding and reporting Red Hat product usage
Red Hat Security Advisory: Insights proxy Container Image
Initial GA Release of Red Hat Insights proxy
Red Hat Security Advisory: Cost Management Metrics Operator Update
Cost Management Metrics Operator version 4.4.2 release.
Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 Technology Preview security update
A new set of Red Hat Update Infrastructure container images is now available as a Technology Preview in the Red Hat container registry.
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vul...
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1
cert-manager Operator for Red Hat OpenShift 1.20.1
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...
Red Hat Security Advisory: OpenShift Container Platform 4.18.59 bug fix and security update
Red Hat OpenShift Container Platform release 4.18.59 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)
Red Hat AI Base Images 3.5.5 (Neuron) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)
Red Hat AI Base Images 3.4.6 (Neuron) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (ROCm 7.14)
Red Hat AI Base Images 3.5.5 (ROCm 7.14) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Spyre)
Red Hat AI Base Images 3.4.6 (Spyre) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (ROCm 6.4)
Red Hat AI Base Images 3.4.6 (ROCm 6.4) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (TPU)
Red Hat AI Base Images 3.0.7 (TPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Spyre)
Red Hat AI Base Images 3.5.5 (Spyre) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CPU)
Red Hat AI Base Images 3.4.6 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CUDA 13.0)
Red Hat AI Base Images 3.5.5 (CUDA 13.0) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CUDA 12.9)
Red Hat AI Base Images 3.5.5 (CUDA 12.9) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CUDA)
Red Hat AI Base Images 3.0.7 (CUDA) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CUDA 13.0)
Red Hat AI Base Images 3.4.6 (CUDA 13.0) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Gaudi)
Red Hat AI Base Images 3.4.6 (Gaudi) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (TPU)
Red Hat AI Base Images 3.4.6 (TPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CPU)
Red Hat AI Base Images 3.0.7 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Rubin)
Red Hat AI Base Images 3.5.5 (Rubin) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (ROCm)
Red Hat AI Base Images 3.0.7 (ROCm) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CUDA 12.9)
Red Hat AI Base Images 3.4.6 (CUDA 12.9) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (ROCm 7.1)
Red Hat AI Base Images 3.4.6 (ROCm 7.1) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Gaudi)
Red Hat AI Base Images 3.5.5 (Gaudi) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (Spyre)
Red Hat AI Base Images 3.0.7 (Spyre) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CPU)
Red Hat AI Base Images 3.5.5 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (TPU)
Red Hat AI Base Images 3.5.5 (TPU) is now available.
Red Hat Security Advisory: OpenShift Container Platform 4.19.53 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: OpenShift Container Platform 4.21.40 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: OpenShift Container Platform 4.20.44 bug fix and security update
Red Hat OpenShift Container Platform release 4.20.44 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CUDA 13.0)
Red Hat AI Base Images 3.4.7 (CUDA 13.0) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CPU)
Red Hat AI Base Images 3.0.8 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CUDA)
Red Hat AI Base Images 3.0.8 (CUDA) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 12.9)
Red Hat AI Base Images 3.5.6 (CUDA 12.9) is now available.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

CMS AuthEnvelopedData Processing May Accept Forged Messages

AFFECTED PACKAGES:
Unknown / Unknown
47 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
09/06/2026 17:17
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detectin...
Nouvelle valeur:
CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message.
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detectin...
📊 ENRICHISSEMENT 14/06/2026 05:00
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 14/06/2026 05:00
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 4 Dernière mise à jour: 6 days ago

> REFERENCES

https://github.com/openssl/security/commit/03c1f4d45fb963aee7d5833390c507cd29018...
https://github.com/openssl/security/commit/439ed7d2c0962ce964482727264668bf277c3...
https://github.com/openssl/security/commit/7947e6a81eb8776802f159fb6762cb7fcf7e3...
https://github.com/openssl/security/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c...
https://github.com/openssl/security/commit/d2ca86bcd43e4f17d899f347101766b610767...
https://openssl-library.org/news/secadv/20260609.txt
« BACK_TO_HOME