Multiple vulnerabilities in OpenSSL
FreeBSD-SA-26:35.openssl · CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447
Our decision for FreeSense
FreeBSD corrected this on 2026-06-09, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2026-06-09
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available.
What FreeBSD says
Multiple issues have been reported as part of this advisory with different issues affecting different OpenSSL versions and therefore different FreeBSD versions. Instead of exhaustively listing detailed writeups for each issue, please see the referenced advisory from OpenSSL. Issues affecting FreeBSD 15.x (OpenSSL 3.5): CVE-2026-7383 - Possible heap buffer overflow in ASN.1 string conversion CVE-2026-9076 - Out-of-bounds read in CMS password-based decryption CVE-2026-34180 - Heap buffer over-read in ASN.1 content parsing CVE-2026-34181 - PKCS#12 files with PBMAC1 accepted with short HMAC keys CVE-2026-34182 - CMS AuthEnvelopedData may accept forged messages CVE-2026-34183 - Unbounded memory growth in the QUIC PATH_CHALLENGE handler CVE-2026-42764 - NULL dereference in QUIC server initial packet handling CVE-2026-42766 - Possible NULL dereference in password-based CMS decryption CVE-2026-4
Impact
The issues include heap buffer overflows and over-reads, NULL pointer dereferences, a use-after-free, unbounded memory allocation, and several cryptographic flaws permitting message forgery, integrity bypass, or recovery of a private key. Security impact ranges from a Denial of Service to a potential remote code execution. See the OpenSSL advisory for specific details.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.