RLSA-2026:98588: Moderate: openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing (CVE-2026-35189)

openssl: openssl: Denial of Service via excessive QUIC packet buffer retention (CVE-2026-54873)

openssl: openssl: Denial of Service via crafted CMP certificate revocation response (CVE-2026-75805)

openssl: openssl: Denial of Service via inefficient QUIC stream reassembly (CVE-2026-42772)

openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations (CVE-2026-54872)

openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control (CVE-2026-75804)

openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V (CVE-2026-54875)

openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting (CVE-2026-35191)

openssl: OpenSSL: Private key recovery via SM2 timing side-channel (CVE-2026-77696)

openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch (CVE-2026-72897)

openssl: OpenSSL: Denial of Service via undersized DTLS record (CVE-2026-75806)

openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog (CVE-2026-84784)

Bug Fix(es) and Enhancement(s):

[Rocky Linux 10.3]OpenSSL silently uses default provider when fips.so is missing on systems in FIPS mode (JIRA:Rocky Linux-213740)

OpenSSL fails to initialize when automatic initialization happens in threads (JIRA:Rocky Linux-252344)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.