RHSA-2026:98588: Moderate: openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.Security Fix(es): openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing (CVE-2026-35189) openssl: openssl: Denial of Service via excessive QUIC packet buffer retention (CVE-2026-54873) openssl: openssl: Denial of Service via crafted CMP certificate revocation response (CVE-2026-75805) openssl: openssl: Denial of Service via inefficient QUIC stream reassembly (CVE-2026-42772) openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations (CVE-2026-54872) openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control (CVE-2026-75804) openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V (CVE-2026-54875) openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting (CVE-2026-35191) openssl: OpenSSL: Private key recovery via SM2 timing side-channel (CVE-2026-77696) openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch (CVE-2026-72897) openssl: OpenSSL: Denial of Service via undersized DTLS record (CVE-2026-75806) openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog (CVE-2026-84784) Bug Fix(es) and Enhancement(s): [RHEL 10.3]OpenSSL silently uses default provider when fips.so is missing on systems in FIPS mode (JIRA:RHEL-213740) OpenSSL fails to initialize when automatic initialization happens in threads (JIRA:RHEL-252344) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.