CVE-2026-72897

/// Technical description

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a

connection to a different SSL_CTX part way through a handshake may access

memory beyond the end of an internal array if the replacement context knows

about more provider signature algorithms than the context the connection was

created from. Applications which never call SSL_set_SSL_CTX() are not

affected.

Impact summary: A remote peer may be able to cause a small out-of-bounds

read, and in some circumstances a fixed-value out-of-bounds write, on the

server heap. This may lead to a Denial of Service.

CWE: CWE-787: Out-of-bounds Write

Description: A TLS connection records how many certificate slots it has

when it is created, taken from the SSL_CTX that created it: the built-in

certificate types plus one slot for each provider TLS-SIGALG entry that

context was aware of. That count sizes an internal array of per-slot

certificate validity flags.

An application may replace a connection's SSL_CTX part way through the

han

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References