The OpenSSL poject reports:
- Heap Buffer Overflow in CMS Key Unwrapping (CVE-2026-63072) (Moderate)
- Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (CVE-2026-63076) (Moderate)
- RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (CVE-2026-14457) (Low)
- Excessive Memory Use Buffering DTLS Records for a Future Epoch (CVE-2026-54874) (Low)
- Untrusted Sender DN Used as Format String in CMP Response Validation (CVE-2026-63073) (Low)
- CMP Indefinite Cache Growth of ExtraCerts (CVE-2026-63074) (Low)
- QUIC ACK-only Packet Retention Can Cause Memory Exhaustion (CVE-2026-63075) (Low)
- AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() (CVE-2026-75803) (Low)