OpenSSL details five low severity flaws across its products

OpenSSL has published a security advisory (dated 10 November 2026) detailing five vulnerabilities that affect the OpenSSL product line, all classified as Low severity. The issues span the QUIC stack, AES-GCM-SIV encryption, and CMS encryption, with fixes already present in the public GitHub repository ahead of official releases. OpenSSL notes that official versions addressing these flaws are planned for release on 1 December 2026.

The affected branches are OpenSSL 4.1, 4.0 and 3.5, while OpenSSL 3.0, 1.1.1 and 1.0.2 are affected only by the CMS flaw. The advisory also states that none of the issues affect the FIPS modules, and that no public exploitation or proof-of-concept has been reported.

The five CVEs are CVE-2026-88822 and CVE-2026-95691 in QUIC, CVE-2026-88823 and CVE-2026-95692 in AES-GCM-SIV, and CVE-2026-107496 which causes an infinite loop in CMS_encrypt() when a recipient EC certificate declares a group order of 1. The QUIC flaws involve a buffer-length mix-up during peer detection leading to data leakage to passive observers and potential connection breaks, and a use-after-free read that could crash the client or leak a byte of heap data.

The AES-GCM-SIV issues include an AAD update reset that could allow forgery, and incorrect IV length handling that can cause heap reads or silent truncation. OpenSSL recommends upgrading to OpenSSL 4.1.1, 4.0.4 or 3.5.10 when released on 1 December 2026; prior to that, affected teams may build from patched GitHub sources.