{"schema":"vulnpedia.research/1","cve":"CVE-2026-28388","references":[{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["vendor-advisory","Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","origins":[{"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","url":"https://openssl-library.org/news/secadv/20260407.txt"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://openssl-library.org/news/secadv/20260407.txt"},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://openssl-library.org/news/secadv/20260407.txt"}]},{"url":"https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","tags":["patch","Patch"],"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","origins":[{"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","url":"https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3"}]},{"url":"https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","tags":["patch","Patch"],"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","origins":[{"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","url":"https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726"}]},{"url":"https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","tags":["patch","Patch"],"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","origins":[{"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","url":"https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8"}]},{"url":"https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","tags":["patch","Patch"],"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","origins":[{"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","url":"https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139"}]},{"url":"https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","tags":["patch","Patch"],"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","origins":[{"source":"mitre","sourceId":"openssl","modified":"2026-04-07T22:00:52.382Z","url":"https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e"}]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","tags":[],"source":"mitre","sourceId":"siemens-SADP","modified":"2026-10-15T01:15:33.077Z","origins":[{"source":"mitre","sourceId":"siemens-SADP","modified":"2026-10-15T01:15:33.077Z","url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","tags":[],"source":"mitre","sourceId":"siemens-SADP","modified":"2026-10-15T01:15:33.077Z","origins":[{"source":"mitre","sourceId":"siemens-SADP","modified":"2026-10-15T01:15:33.077Z","url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"},{"source":"nvd","sourceId":"CVE-2026-28388","modified":"2026-07-24T23:10:00.563","url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28388","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-28388"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28388","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-28388"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:7261","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://access.redhat.com/errata/RHSA-2026:7261"}]},{"source":"euvd","sourceId":"EUVD-2026-19962","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19962","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-19962","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19962"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"Red Hat Hardened Images:openssl-main@aarch64","product":"openssl-main@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:7261"},{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."}],"purl":"pkg:rpm/redhat/openssl@3.5.6-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"Red Hat Hardened Images:openssl-main@src","product":"openssl-main@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:7261"},{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."}],"purl":"pkg:rpm/redhat/openssl@3.5.6-0.1.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"Red Hat Hardened Images:openssl-main@x86_64","product":"openssl-main@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:7261"},{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."}],"purl":"pkg:rpm/redhat/openssl@3.5.6-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_10:edk2-aarch64","product":"edk2-aarch64 as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/edk2-aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_10:edk2-tools","product":"edk2-tools as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/edk2-tools","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_10:mokutil","product":"mokutil as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/mokutil","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_10:openssl-devel","product":"openssl-devel as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_10:openssl.src","product":"openssl.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_10:shim-unsigned-aarch64.src","product":"shim-unsigned-aarch64.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/shim-unsigned-aarch64?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_6:openssl","product":"openssl as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_6:openssl-perl","product":"openssl-perl as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl-perl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_7:AAVMF","product":"AAVMF as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/AAVMF","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_7:openssl","product":"openssl as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_7:openssl-perl","product":"openssl-perl as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl-perl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_7:openssl.src","product":"openssl.src as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:compat-openssl10.src","product":"compat-openssl10.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/compat-openssl10?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:edk2-ovmf","product":"edk2-ovmf as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/edk2-ovmf","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:mingw-openssl.src","product":"mingw-openssl.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/mingw-openssl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:openssl","product":"openssl as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:openssl-libs","product":"openssl-libs as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl-libs","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:openssl.src","product":"openssl.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:shim-ia32","product":"shim-ia32 as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/shim-ia32","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_8:shim-x64","product":"shim-x64 as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/shim-x64","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:compat-openssl11","product":"compat-openssl11 as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/compat-openssl11","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:edk2-ovmf","product":"edk2-ovmf as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/edk2-ovmf","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:edk2-tools-doc","product":"edk2-tools-doc as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/edk2-tools-doc","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:openssl-devel","product":"openssl-devel as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:openssl-perl","product":"openssl-perl as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl-perl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:shim-unsigned-aarch64.src","product":"shim-unsigned-aarch64.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/shim-unsigned-aarch64?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_enterprise_linux_9:shim-unsigned-x64.src","product":"shim-unsigned-x64.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/shim-unsigned-x64?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_jboss_core_services:openssl","product":"openssl as a component of Red Hat JBoss Core Services","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openssl","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]},{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","product":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, ensure that delta CRL processing is not enabled in applications that do not require it. This vulnerability is only exploitable when the `X509_V_FLAG_USE_DELTAS` flag is explicitly set within the X.509 verification context. Review application configurations to confirm that this flag is not enabled unless absolutely necessary for your security policy. Disabling this flag will prevent the vulnerable code path from being exercised. Specific implementation details will vary depending on the application utilizing X.509 certificate verification."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9","origins":[{"source":"redhat","sourceId":"CVE-2026-28388","modified":"2026-09-01T12:10:39+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28388.json"}]}],"vendorCoverage":{"total":73,"shown":32,"omitted":41,"source":"redhat"}}