Multiple OpenSSL Vulnerabilities Exposes Sensitive Data in RSA KEM Handling

Cybersecuritynews •Guru Baran • April 8, 2026

OpenSSL has released a broad April 2026 security update that fixes seven vulnerabilities across supported branches, led by CVE-2026-31790, a moderate-severity flaw in RSA KEM RSASVE encapsulation that can expose uninitialized memory to a malicious peer. The advisory directs users of vulnerable 3.x releases to move to OpenSSL 3.0.20, 3.3.7, 3.4.5, 3.5.6, or 3.6.2, depending […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenSSL 3.6.2 Addresses Multiple Vulnerabilities Including RSA KEM Flaw OpenSSL has released version 3.6.2 on April 8, 2026, which addresses eight vulnerabilities, including CVE-2026-31790, a moderate-severity flaw in RSA KEM RSASVE encapsulation. This vulnerability can expose uninitialized memory to attackers, potentially leading to sensitive data leakage. Other notable fixes include CVE-2026-2673, which corrects a loss of key agreement group structure, and CVE-2026-28386, which resolves an out-of-bounds read issue in AES-CFB-128 on x86-64 CPUs. Users of OpenSSL 3.x are advised to upgrade to the latest version or specific earlier versions to mitigate these risks. The vulnerabilities affect various components of OpenSSL, emphasizing the need for timely updates. The project rates the most severe issue as moderate, indicating a significant but not critical threat level. Current status is that the patch is available and users are encouraged to implement it immediately. 4 sources 58

Extracted Entities

CVEs (1)

CVE-2026-31790

Tools (1)

Openssl