Back Linuxsecurity

SUSE openssl-1_1-livepatches Important DoS Heap Overflow Patch 2026-4036

Linuxsecurity •LinuxSecurity Advisories • September 8, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for openssl-1_1-livepatches fixes the following issues: * CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788). * HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker- controlled memory allocations (bsc#1271712, bsc#1271713). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP6 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2026-4036=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-4036=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP6 (x86_64) * openssl-1_1-livepatches-0.8-150600.11.9.1

* CVE-2026-63072 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2026-63072 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Enterprise Live Patching 15-SP6

* SUSE Linux Enterprise Real Time 15 SP6

* SUSE Linux Enterprise Server 15 SP6

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves one vulnerability and has three security fixes can now be

Announcement ID: SUSE-SU-2026:4036-1 Release Date: 2026-09-07T08:28:51Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OpenSSL Vulnerabilities Affecting openSUSE and SUSE snphost Two important advisories were released addressing multiple vulnerabilities in OpenSSL affecting openSUSE and SUSE snphost. The advisories detail several CVEs, including CVE-2026-54874 and CVE-2026-63072 for openSUSE, and CVE-2026-41677 and CVE-2026-41898 for SUSE snphost. The vulnerabilities range from buffer overflows to out-of-bounds reads, potentially allowing attackers to exploit these flaws for unauthorized access or denial of service. The patches are critical for systems running SUSE Linux Enterprise Server and openSUSE Leap. Administrators are urged to apply the patches immediately to mitigate risks. The vulnerabilities were disclosed between April and August 2026, with some having proof-of-concept code available. Current status indicates that while some vulnerabilities are patched, others may still pose a risk if not addressed promptly. 17 sources 65

Extracted Entities

SUSE openssl-1_1-livepatches Important DoS Heap Overflow Patch 2026-4036

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)