Multiple OpenSSL Flaws Expose Sensitive Data in RSA KEM Handling

Gbhackers •Divya • April 8, 2026

A newly disclosed flaw in OpenSSL could allow attackers to access sensitive data stored in application memory. Tracked as CVE-2026-31790, this moderate-severity vulnerability affects the handling of RSA Key Encapsulation Mechanism (KEM) RSASVE encapsulation. OpenSSL issued the security advisory on April 7, 2026, urging users to apply patches immediately. The core issue revolves around improper […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenSSL 3.6.2 Addresses Multiple Vulnerabilities Including RSA KEM Flaw OpenSSL has released version 3.6.2 on April 8, 2026, which addresses eight vulnerabilities, including CVE-2026-31790, a moderate-severity flaw in RSA KEM RSASVE encapsulation. This vulnerability can expose uninitialized memory to attackers, potentially leading to sensitive data leakage. Other notable fixes include CVE-2026-2673, which corrects a loss of key agreement group structure, and CVE-2026-28386, which resolves an out-of-bounds read issue in AES-CFB-128 on x86-64 CPUs. Users of OpenSSL 3.x are advised to upgrade to the latest version or specific earlier versions to mitigate these risks. The vulnerabilities affect various components of OpenSSL, emphasizing the need for timely updates. The project rates the most severe issue as moderate, indicating a significant but not critical threat level. Current status is that the patch is available and users are encouraged to implement it immediately. 4 sources 58

Extracted Entities

Multiple OpenSSL Flaws Expose Sensitive Data in RSA KEM Handling

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Tools (1)