Ubuntu 26.10 curl checks certificate revocation; OpenSSL is next
The check uses local CRLite data via upki, so curl no longer waits on a network revocation lookup.
Stories per day · 30 days
2 RSS
Relatedtls11goahead4nodejs3apache2apex2brotli2cert-cc2certificate-revocation2cms2critical-patch-update2crlite2cryptography2curl2denial-of-service2dtls2embedded2embedthis2gnutls2
43 stories, newest first · one card per story
Stories tagged #openssl
OpenSSL merges five low-severity fixes ahead of December releases
Fixes are in the public GitHub repository; packaged releases are scheduled for December 1, 2026.
Progress patches five high-severity flaws in WS_FTP Server
The recommended build is 2025.0.5, also called 10.0.5; the notice reports no active exploitation.
Azure Linux 3.0.2022 bundles more than 470 CVE fixes
The kernel moves to 6.6.161.1, and Microsoft distrusts certificates tied to the eMudhra incident.
Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)
pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.
GoAhead TLS flaws can ignore CRLs, weaken encryption, or bypass chain limits
FoxIO published PoCs for three configuration-specific bugs; GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues.
GoAhead before 6.1.1 has three TLS bugs in crypto backends
A foxio.io write-up covers flaws in GoAhead's OpenSSL, LibreSSL, and Mbed TLS code; the note omits the details.
Three GoAhead TLS bugs skip CRLs, depth limits, or weaken DH
Fixes are in GoAhead 6.1.1 for the OpenSSL-compatible and mbed TLS cases; a public PoC decrypts weak DHE sessions.
GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.
OpenSSL 4.1.0 adds DTLS 1.3 and post-quantum speedups
The October 23 feature release is not a security patch and documents four DTLS issues still awaiting a fix.
OpenSSL 4.1.0 adds DTLS 1.3 and ships four known DTLS bugs
Two bugs can misreport connection state, one can abort handshakes after packet loss, and KeyUpdate can drop a lost NewSessionTicket.
SecPRBench measures agentic security review on real bug-introducing commits
Recall spans 32.5% to 78.1% across eight frontier models on 265 tasks from nine systems, led by Grok 4.6 and GPT-6 sol.
Node.js security-release thread cites Envoy and OpenSSL advisories
The truncated reply links two GitHub advisories and only suggests OpenSSL processing may be involved.
OpenSSL 4.1.0 release appears on Hacker News
The feed snippet only shows 43 points and 8 comments, with no changelog or security notes.
Node.js patches 10 flaws, including Brotli decoder RCE
Fixed builds are 26.12.1, 24.22.1, and 22.23.4; the advisory gives no evidence of active exploitation.
OpenSSL CMP format-string flaw can leak data without login
ZDI rates CVE-2026-63073 at CVSS 6.5; remote attackers need no authentication, and no fixed version is named.
Node.js patches high-severity flaws in 22.x, 24.x, and 26.x
Fixes include a Brotli out-of-bounds write that can allow remote code execution, plus TLS hostname bypasses.
Oracle October 2026 CPU fixes unauthenticated E-Business Suite takeover bug
CVE-2026-101809 scores CVSS 10.0 in Workflow Notification Mailer 12.2.3–12.2.15; three other issues rate 9.8, with no confirmed exploitation.
8
Oracle October 2026 CPU issues 1,295 patches, including CVSS 9.8 flaws
Six hundred ninety patches are remotely exploitable without authentication, spanning database, middleware, Java and applications.
5
Tomcat keeps starting if OpenSSL FIPS activation fails (CVE-2026-74048)
With OpenSSLLifecycleListener in FIPS mode, a failed activation leaves Tomcat on non-FIPS JSSE; severity is low.
Hitachi Energy RTU500 CMU firmware flaws can disrupt ICS communications
Builds from 12.7.1 through 13.8.2 should move to 13.9.1 or named branch fixes; exploitation is not stated.
7
sslx: A fast, modern alternative to OpenSSL's CLI
sslx is pitched as a faster, modern command-line alternative to OpenSSL.
VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
3
VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
CERT/CC warns TLS libraries inconsistently enforce X.509 name constraints, with fixes for GnuTLS and pyca/cryptography.
4